Bug #78598 [Opn->Csd]: Changing array during undef index RW error segfaults
Edit report at https://bugs.php.net/bug.php?id=78598&edit=1
ID: 78598
Updated by: nikic@php.net
Reported by: nikic@php.net
Summary: Changing array during undef index RW error segfaults
-Status: Open
+Status: Closed
Type: Bug
Package: Scripting Engine problem
PHP Version: 7.2.22
Block user comment: N
Private report: N
New Comment:
Automatic comment on behalf of nikita.ppv@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=220880ad2d54d10173a250637478da213b1ae8e2
Log: Fixed bug #78598
Previous Comments:
------------------------------------------------------------------------
[2020-02-04 14:02:19] nikic@php.net
Related To: Bug #79209
------------------------------------------------------------------------
[2020-02-04 13:29:49] nikic@php.net
Related To: Bug #79208
------------------------------------------------------------------------
[2020-02-03 15:35:04] nikic@php.net
Related To: Bug #79208
------------------------------------------------------------------------
[2019-09-26 10:44:44] nikic@php.net
Description:
------------
After the undef index notice is thrown, we still assume that the variable is an array, even though
the type might have changed in the meantime.
Not really sure what we can do about this, especially when we're dealing with a deeply nested
array that has been destroyed.
Test script:
---------------
<?php
$my_var = null;
set_error_handler(function() use(&$my_var) {
$my_var = 0;
});
$my_var[0] .= "xyz";
Actual result:
--------------
php: /home/nikic/php-7.2/Zend/zend_hash.c:712: _zend_hash_index_add_or_update_i: Assertion
`((ht)->gc.refcount == 1) || ((ht)->u.flags & (1<<6))' failed.
Aborted
nikic@MUNIT-271:~/php-7.2$ vim t036.php
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=78598&edit=1
Thread (6 messages)