Bug #78502 [Opn]: Segmentation Fault in array_map

Edit report at https://bugs.php.net/bug.php?id=78502&edit=1 ID: 78502 User updated by: phofstetter at sensational dot ch Reported by: phofstetter at sensational dot ch Summary: Segmentation Fault in array_map Status: Open Type: Bug Package: Reproducible crash Operating System: macos 10.14, Debian 10 PHP Version: 7.4.0RC1 Block user comment: N Private report: N New Comment: one last update: This happens independently of whether opcache is loaded or not. Previous Comments: ------------------------------------------------------------------------ [2019-09-06 06:41:05] phofstetter at sensational dot ch On Debian 10, the attached test script also crashes with a debugger attached. Here's the backtrace: (gdb) run segv.php Starting program: /opt/php/7.4/bin/php segv.php [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Program received signal SIGSEGV, Segmentation fault. 0x0000555555a881fb in zend_call_function (fci=fci@entry=0x7fffffffa8a0, fci_cache=fci_cache@entry=0x7fffffffa880) at /home/crazyhat/downloads/php-7.4.0RC1/Zend/zend_execute_API.c:681 681 } else if (EG(current_execute_data)->func && (gdb) bt #0 0x0000555555a881fb in zend_call_function (fci=fci@entry=0x7fffffffa8a0, fci_cache=fci_cache@entry=0x7fffffffa880) at /home/crazyhat/downloads/php-7.4.0RC1/Zend/zend_execute_API.c:681 #1 0x00005555559c6428 in zif_array_map (execute_data=<optimized out>, return_value=0x7ffff4013350) at /home/crazyhat/downloads/php-7.4.0RC1/ext/standard/array.c:6203 #2 0x0000555555b10820 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at /home/crazyhat/downloads/php-7.4.0RC1/Zend/zend_vm_execute.h:1323 #3 execute_ex (ex=0x7fffffffa8a0) at /home/crazyhat/downloads/php-7.4.0RC1/Zend/zend_vm_execute.h:53461 #4 0x0000555555a88826 in zend_call_function (fci=fci@entry=0x7fffffffaaf0, fci_cache=<optimized out>, fci_cache@entry=0x7fffffffaad0) at /home/crazyhat/downloads/php-7.4.0RC1/Zend/zend_execute_API.c:816 #5 0x00005555559c6428 in zif_array_map (execute_data=<optimized out>, return_value=0x7ffff4013170) at /home/crazyhat/downloads/php-7.4.0RC1/ext/standard/array.c:6203 #6 0x0000555555b10820 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER () at /home/crazyhat/downloads/php-7.4.0RC1/Zend/zend_vm_execute.h:1323 #7 execute_ex (ex=0x7fffffffa8a0) at /home/crazyhat/downloads/php-7.4.0RC1/Zend/zend_vm_execute.h:53461 #8 0x0000555555b16a63 in zend_execute (op_array=0x7ffff407c2a0, return_value=<optimized out>) at /home/crazyhat/downloads/php-7.4.0RC1/Zend/zend_vm_execute.h:57561 #9 0x0000555555a964c4 in zend_execute_scripts (type=type@entry=8, retval=0x7ffff40130b0, retval@entry=0x0, file_count=file_count@entry=3) at /home/crazyhat/downloads/php-7.4.0RC1/Zend/zend.c:1663 #10 0x0000555555a39fa0 in php_execute_script (primary_file=<optimized out>) at /home/crazyhat/downloads/php-7.4.0RC1/main/main.c:2619 #11 0x0000555555b18a66 in do_cli (argc=2, argv=0x55555677a5d0) at /home/crazyhat/downloads/php-7.4.0RC1/sapi/cli/php_cli.c:961 #12 0x0000555555794239 in main (argc=2, argv=0x55555677a5d0) at /home/crazyhat/downloads/php-7.4.0RC1/sapi/cli/php_cli.c:1352 ------------------------------------------------------------------------ [2019-09-06 06:33:17] phofstetter at sensational dot ch Also happens on Debian 10 ------------------------------------------------------------------------ [2019-09-06 06:12:37] phofstetter at sensational dot ch Description: ------------ The test script attached to this bug report will cause a segmenation fault, however, unfortunately, it doesn't happen when a debubgger is attached(??) pilif@celes:~| ⇒ php --version PHP 7.4.0RC1 (cli) (built: Sep 6 2019 07:35:43) ( NTS ) Copyright (c) The PHP Group Zend Engine v3.4.0-dev, Copyright (c) Zend Technologies pilif@celes:~| ⇒ php segv.php [1] 73522 segmentation fault php segv.php pilif@celes:~| ⇒ Test script: --------------- <?php $tree = [ 'name' => 'a', 'quant' => 1, 'children' => [ ['name' => 'b', 'quant' => 1], ['name' => 'c', 'quant' => 1, 'children' => [ ['name' => 'd', 'quant' => 1], ]], ], ]; function tree_map($tree, $recursive_attr, closure $callback){ if(isset($tree[$recursive_attr])){ $tree[$recursive_attr] = array_map(function($c) use($recursive_attr, $callback){ return tree_map($c, $recursive_attr, $callback); }, $tree[$recursive_attr]); } return $callback($tree); } tree_map($tree, 'children', function ($node) {}); Expected result: ---------------- no segfault Actual result: -------------- segfault. My attempts at getting a proper backtrace were foiled by this not crashing when e debugger is attached. However, a slightly more complicated version of the script produced the following trace in lldb: pilif@celes:~| ⇒ lldb php (lldb) target create "php" Current executable set to 'php' (x86_64). (lldb) run segv.php Process 96419 launched: '/usr/local/bin/php' (x86_64) Process 96419 stopped * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT) frame #0: 0x00000001003c2a3c php`zend_leave_helper_SPEC + 60 php`zend_leave_helper_SPEC: -> 0x1003c2a3c <+60>: decl (%rdi) 0x1003c2a3e <+62>: je 0x1003c2a66 ; <+102> 0x1003c2a40 <+64>: movl 0x4(%rdi), %eax 0x1003c2a43 <+67>: cmpl $0xa, %eax Target 0: (php) stopped. (lldb) bt * thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT) * frame #0: 0x00000001003c2a3c php`zend_leave_helper_SPEC + 60 frame #1: 0x000000010037f4ff php`execute_ex + 35 frame #2: 0x0000000100335102 php`zend_call_function + 1230 frame #3: 0x0000000100256cc0 php`zif_array_map + 448 frame #4: 0x00000001003b0365 php`ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER + 80 frame #5: 0x000000010037f4ff php`execute_ex + 35 frame #6: 0x000000010037f6b7 php`zend_execute + 352 frame #7: 0x0000000100342981 php`zend_execute_scripts + 338 frame #8: 0x00000001002eb7bc php`php_execute_script + 482 frame #9: 0x00000001003c86fb php`do_cli + 3893 frame #10: 0x00000001003c7659 php`main + 1229 frame #11: 0x00007fff644192a5 libdyld.dylib`start + 1 (lldb) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78502&edit=1