Bug #78986 [Ver->Csd]: Opcache segfaults when inheriting ctor from immutable into mutable class

Edit report at https://bugs.php.net/bug.php?id=78986&edit=1 ID: 78986 Updated by: nikic@php.net Reported by: j124519951 at gmail dot com Summary: Opcache segfaults when inheriting ctor from immutable into mutable class -Status: Verified +Status: Closed Type: Bug Package: opcache Operating System: Linux PHP Version: 7.4.0 Assigned To: nikic Block user comment: N Private report: N New Comment: Automatic comment on behalf of nikita.ppv@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=bd4fce4f6f5f40f71802f0b2ad12a925af0667c1 Log: Fixed bug #78986 Previous Comments: ------------------------------------------------------------------------ [2019-12-18 10:33:07] nikic@php.net The problem is that zend_update_inherited_handler() assumes that handlers are in arena memory, which is not necessarily the case if the parent class is immutable (but the current one is not). ------------------------------------------------------------------------ [2019-12-18 10:24:51] nikic@php.net First valgrind warning: ==28606== Conditional jump or move depends on uninitialised value(s) ==28606== at 0x98F5E4: zend_std_get_constructor (zend_object_handlers.c:1579) ==28606== by 0x9BBA03: ZEND_NEW_SPEC_CONST_UNUSED_HANDLER (zend_vm_execute.h:9226) ==28606== by 0xA11659: execute_ex (zend_vm_execute.h:54335) ==28606== by 0xA14B9E: zend_execute (zend_vm_execute.h:57665) ==28606== by 0x938FEE: zend_execute_scripts (zend.c:1665) ==28606== by 0x89B0E5: php_execute_script (main.c:2617) ==28606== by 0xA17770: do_cli (php_cli.c:961) ==28606== by 0xA188DA: main (php_cli.c:1352) Pretty weird. ------------------------------------------------------------------------ [2019-12-18 05:33:19] requinix@php.net Backtrace with 7.4.1. Doesn't say much. (gdb) bt #0 0x0000000000000000 in ?? () #1 0x00000000086fc68c in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at /root/php/src/Zend/zend_vm_execute.h:1617 #2 0x0000000008760401 in execute_ex (ex=0x7ffff5013020) at /root/php/src/Zend/zend_vm_execute.h:53584 #3 0x00000000087644bd in zend_execute (op_array=0x7ffff5074300, return_value=0x0) at /root/php/src/Zend/zend_vm_execute.h:57664 #4 0x000000000868880c in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /root/php/src/Zend/zend.c:1663 #5 0x00000000085ea184 in php_execute_script (primary_file=0x7ffffffed070) at /root/php/src/main/main.c:2619 #6 0x000000000876709d in do_cli (argc=6, argv=0x965b940) at /root/php/src/sapi/cli/php_cli.c:961 #7 0x00000000087681ef in main (argc=6, argv=0x965b940) at /root/php/src/sapi/cli/php_cli.c:1352 (gdb) f 1 #1 0x00000000086fc68c in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at /root/php/src/Zend/zend_vm_execute.h:1617 1617 fbc->internal_function.handler(call, ret); (gdb) f 2 #2 0x0000000008760401 in execute_ex (ex=0x7ffff5013020) at /root/php/src/Zend/zend_vm_execute.h:53584 53584 ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU); ------------------------------------------------------------------------ [2019-12-18 05:11:58] j124519951 at gmail dot com This is no issue if I disable opcache. I use docker to build the test environment, not install any extensions except opcache. # Docker file begin FROM php:7.4-fpm-alpine RUN docker-php-ext-install opcache # Docker file end # make sure enable opcache in php.ini Test script same as what I send before. ------------------------------------------------------------------------ [2019-12-18 04:28:30] requinix@php.net Thank you for this bug report. To properly diagnose the problem, we need a short but complete example script to be able to reproduce this bug ourselves. A proper reproducing script starts with <?php and ends with ?>, is max. 10-20 lines long and does not require any external resources such as databases, etc. If the script requires a database to demonstrate the issue, please make sure it creates all necessary tables, stored procedures etc. Please avoid embedding huge scripts into the report. Seems fine. https://3v4l.org/LhvkT Do you have any Zend extensions activated? Is there any difference if you enable or disable opcache? ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=78986 -- Edit this bug report at https://bugs.php.net/bug.php?id=78986&edit=1