Bug #79744 [NEW]: OOM in array-to-object cast on ppc64el

From: jbboehr Operating system: ubuntu bionic ppc64el PHP version: 7.4.7 Package: Reproducible crash Bug Type: Bug Bug description:OOM in array-to-object cast on ppc64el Description: ------------ I was testing my code against the ppc64le architecture on TravisCI and ran into this issue. I've had the error both on TravisCI and using qemu-system-ppc64 with ondrej/php. I don't believe I had the same problem on PHP 7.2. $ uname -a Linux ubuntu 4.15.0-106-generic #107-Ubuntu SMP Thu Jun 4 11:27:34 UTC 2020 ppc64le ppc64le ppc64le GNU/Linux $ php --version PHP 7.4.7 (cli) (built: Jun 12 2020 07:44:05) ( NTS ) Copyright (c) The PHP Group Zend Engine v3.4.0, Copyright (c) Zend Technologies with Zend OPcache v7.4.7, Copyright (c), by Zend Technologi $ apt-cache show php7.4-dev Package: php7.4-dev Source: php7.4 Priority: optional Section: php Installed-Size: 5289 Maintainer: Debian PHP Maintainers <team+pkg-php@tracker.debian.org> Architecture: ppc64el Version: 7.4.7-1+ubuntu18.04.1+deb.sury.org+1 --- With this: printf "run\nbt" | USE_ZEND_ALLOC=0 gdb --args php -r '(object)[];' and then killing while it's busy allocating my entire system memory with kill -3, I get: zend_array_dup (source=0x10050de48 <zend_empty_array>) at ./Zend/zend_hash.c:2054 2054 ./Zend/zend_hash.c: No such file or directory. (gdb) #0 zend_array_dup (source=0x10050de48 <zend_empty_array>) at ./Zend/zend_hash.c:2054 #1 0x00000001000f85a0 in ZEND_CAST_SPEC_CONST_HANDLER () at ./Zend/zend_vm_execute.h:4026 #2 0x00000001003f68ac in execute_ex (ex=<optimized out>) at ./Zend/zend_vm_execute.h:54112 #3 0x0000000100400164 in zend_execute (op_array=0x1006194b0, return_value=<optimized out>) at ./Zend/zend_vm_execute.h:57922 #4 0x000000010031b40c in zend_eval_stringl (str=0x100542430 "(object)[];", str_len=<optimized out>, retval_ptr=0x0, string_name=0x100469fd0 "Command line code") at ./Zend/zend_execute_API.c:1088 #5 0x000000010031b670 in zend_eval_stringl_ex (str=<optimized out>, str_len=<optimized out>, retval_ptr=<optimized out>, string_name=<optimized out>, handle_exceptions=<optimized out>) at ./Zend/zend_execute_API.c:1129 #6 0x000000010031b724 in zend_eval_string_ex (str=0x100542430 "(object)[];", retval_ptr=0x0, string_name=0x100469fd0 "Command line code", handle_exceptions=<optimized out>) at ./Zend/zend_execute_API.c:1140 #7 0x0000000100402bd8 in do_cli (argc=<optimized out>, argv=0x1005423c0) at ./sapi/cli/php_cli.c:992 #8 0x00000001000fc7e8 in main (argc=<optimized out>, argv=0x1005423c0) at ./sapi/cli/php_cli.c:1356 Test script: --------------- This is all that is needed to reproduce it: php -r 'var_dump((object) []);' The QEMU setup script I'm using: https://gist.github.com/jbboehr/ea36d5347429cbc5c86f251cb851150f Expected result: ---------------- object(stdClass)#1 (0) { } Actual result: -------------- mmap() failed: [12] Cannot allocate memory mmap() failed: [12] Cannot allocate memory PHP Fatal error: Out of memory (allocated 3506438144) (tried to allocate 536870912 bytes) in Command line code on line 1 -- Edit bug report at https://bugs.php.net/bug.php?id=79744&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=79744&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=79744&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=79744&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=79744&r=needscript Try newer version: https://bugs.php.net/fix.php?id=79744&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=79744&r=support Expected behavior: https://bugs.php.net/fix.php?id=79744&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=79744&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=79744&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=79744&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=79744&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=79744&r=dst IIS Stability: https://bugs.php.net/fix.php?id=79744&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=79744&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=79744&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=79744&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=79744&r=mysqlcfg