Bug #78644 [NEW]: SEGFAULT in ZEND_UNSET_OBJ_SPEC_VAR_CONST_HANDLER

From: leigh Operating system: Linux PHP version: master-Git-2019-10-08 (Git) Package: Reproducible crash Bug Type: Bug Bug description:SEGFAULT in ZEND_UNSET_OBJ_SPEC_VAR_CONST_HANDLER Description: ------------ Present in PHP-7.4 / master branches but not PHP-7.3 branch. Compiled with --disable-all. Found using AFL. I'm not sure what is going on here, removing the unused property or the body of the insert() method in the test script cause execution to pass successfully. Test script: --------------- <?php class Node { public $t; function insert() { $p = $this; } function __destruct() { unset($this->a->b->c); } } $a = new Node; $b = new Node; $a->insert(); unset($a); unset($b); Expected result: ---------------- Exit code 0 Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. ZEND_UNSET_OBJ_SPEC_VAR_CONST_HANDLER () at /home/leigh/php-src/Zend/zend_vm_execute.h:23985 23985 Z_OBJ_HT_P(container)->unset_property(Z_OBJ_P(container), name, ((IS_CONST == IS_CONST) ? CACHE_ADDR(opline->extended_value) : NULL)); (gdb) bt #0 ZEND_UNSET_OBJ_SPEC_VAR_CONST_HANDLER () at /home/leigh/php-src/Zend/zend_vm_execute.h:23985 #1 0x0000555555b30c55 in execute_ex (ex=0x7ffff7a14100) at /home/leigh/php-src/Zend/zend_vm_execute.h:56166 #2 0x0000555555a49e36 in zend_call_function (fci=0x7fffffffa2c0, fci_cache=0x7fffffffa2a0) at /home/leigh/php-src/Zend/zend_execute_API.c:784 #3 0x0000555555aac838 in zend_objects_destroy_object (object=0x7ffff7a588a0) at /home/leigh/php-src/Zend/zend_objects.c:179 #4 0x0000555555ab3902 in zend_objects_store_del (object=0x7ffff7a588a0) at /home/leigh/php-src/Zend/zend_objects_API.c:178 #5 0x0000555555a5bddf in rc_dtor_func (p=0x7ffff7a588a0) at /home/leigh/php-src/Zend/zend_variables.c:57 #6 0x0000555555b26913 in ZEND_UNSET_CV_SPEC_CV_UNUSED_HANDLER () at /home/leigh/php-src/Zend/zend_vm_execute.h:46565 #7 0x0000555555b324bc in execute_ex (ex=0x7ffff7a14020) at /home/leigh/php-src/Zend/zend_vm_execute.h:57691 #8 0x0000555555b329e1 in zend_execute (op_array=0x7ffff7a84300, return_value=0x0) at /home/leigh/php-src/Zend/zend_vm_execute.h:58019 #9 0x0000555555a5ffb5 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/leigh/php-src/Zend/zend.c:1643 #10 0x00005555559cce5b in php_execute_script (primary_file=0x7fffffffcaf0) at /home/leigh/php-src/main/main.c:2585 #11 0x0000555555b352a0 in do_cli (argc=2, argv=0x555556175860) at /home/leigh/php-src/sapi/cli/php_cli.c:959 #12 0x0000555555b3634c in main (argc=2, argv=0x555556175860) at /home/leigh/php-src/sapi/cli/php_cli.c:1350 -- Edit bug report at https://bugs.php.net/bug.php?id=78644&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=78644&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=78644&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=78644&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=78644&r=needscript Try newer version: https://bugs.php.net/fix.php?id=78644&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=78644&r=support Expected behavior: https://bugs.php.net/fix.php?id=78644&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=78644&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=78644&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=78644&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=78644&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=78644&r=dst IIS Stability: https://bugs.php.net/fix.php?id=78644&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=78644&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=78644&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=78644&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=78644&r=mysqlcfg