Bug #79792 [Ver->Csd]: HT iterators not removed if empty array is destroyed
| From: | nikic@php.net | Date: | Tue, 07 Jul 2020 10:00:59 +0000 |
| Subject: | Bug #79792 [Ver->Csd]: HT iterators not removed if empty array is destroyed | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-227847@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=79792&edit=1
ID: 79792
Updated by: nikic@php.net
Reported by: changochen1 at gmail dot com
Summary: HT iterators not removed if empty array is destroyed
-Status: Verified
+Status: Closed
Type: Bug
Package: Scripting Engine problem
PHP Version: 8.0Git-2020-07-04 (Git)
Block user comment: N
Private report: N
New Comment:
Automatic comment on behalf of nikita.ppv@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=64931fd3c4c7c3d217f2f19c997a8f89779727c5
Log: Fixed bug #79792
Previous Comments:
------------------------------------------------------------------------
[2020-07-07 09:39:41] nikic@php.net
Reduced:
<?php
$a = [42];
foreach ($a as &$c) {
array_shift($a);
$a = null;
}
Valgrind:
==931749== Invalid read of size 1
==931749== at 0x9D84AC: zend_hash_iterator_del (zend_hash.c:562)
==931749== by 0xA16268: ZEND_FE_FREE_SPEC_TMPVAR_HANDLER (zend_vm_execute.h:12928)
==931749== by 0xA66AEF: execute_ex (zend_vm_execute.h:53339)
==931749== by 0xA6A0DE: zend_execute (zend_vm_execute.h:56094)
==931749== by 0x9C442A: zend_execute_scripts (zend.c:1667)
==931749== by 0x92BF71: php_execute_script (main.c:2537)
==931749== by 0xAA9077: do_cli (php_cli.c:955)
==931749== by 0xAAA16F: main (php_cli.c:1353)
==931749== Address 0x8ebc9aa is 10 bytes inside a block of size 56 free'd
==931749== at 0x483CA3F: free (in
/usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==931749== by 0x98A6FA: _efree_custom (zend_alloc.c:2426)
==931749== by 0x98A851: _efree (zend_alloc.c:2546)
==931749== by 0x9DBCF8: zend_array_destroy (zend_hash.c:1662)
==931749== by 0x9BFF72: rc_dtor_func (zend_variables.c:57)
==931749== by 0x9EE297: zend_assign_to_variable (zend_execute.h:141)
==931749== by 0xA50B89: ZEND_ASSIGN_SPEC_CV_CONST_RETVAL_UNUSED_HANDLER (zend_vm_execute.h:39272)
==931749== by 0xA69304: execute_ex (zend_vm_execute.h:55374)
==931749== by 0xA6A0DE: zend_execute (zend_vm_execute.h:56094)
==931749== by 0x9C442A: zend_execute_scripts (zend.c:1667)
==931749== by 0x92BF71: php_execute_script (main.c:2537)
==931749== by 0xAA9077: do_cli (php_cli.c:955)
==931749== Block was alloc'd at
==931749== at 0x483B7F3: malloc (in
/usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==931749== by 0x98B83F: __zend_malloc (zend_alloc.c:2992)
==931749== by 0x98A689: _malloc_custom (zend_alloc.c:2417)
==931749== by 0x98A7D3: _emalloc (zend_alloc.c:2536)
==931749== by 0x9DD2F0: zend_array_dup (zend_hash.c:2072)
==931749== by 0xA492FA: ZEND_FE_RESET_RW_SPEC_CV_HANDLER (zend_vm_execute.h:36337)
==931749== by 0xA68E54: execute_ex (zend_vm_execute.h:55134)
==931749== by 0xA6A0DE: zend_execute (zend_vm_execute.h:56094)
==931749== by 0x9C442A: zend_execute_scripts (zend.c:1667)
==931749== by 0x92BF71: php_execute_script (main.c:2537)
==931749== by 0xAA9077: do_cli (php_cli.c:955)
==931749== by 0xAAA16F: main (php_cli.c:1353)
------------------------------------------------------------------------
[2020-07-04 18:41:41] changochen1 at gmail dot com
Description:
------------
LOG:
---
php: /home/yongheng/php_clean/Zend/zend_hash.c:563: void zend_hash_iterator_del(uint32_t): Assertion
`(iter->ht)->u.v.nIteratorsCount != 0' failed.
---
Test script:
---------------
<?
define ( "THE_CONST" , 3 ) ;
function b ( $a = array ( THE_CONST ) ) {
foreach ( $a as & $c ) {
array_shift ( $a ) ;
list ( $a ) = $b ;
d ;
}
}
b () ;
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=79792&edit=1