Bug #54266 [PATCH]: crash on shutdown when destroying circular references in object

Edit report at https://bugs.php.net/bug.php?id=54266&edit=1 ID: 54266 Patch added by: gfbarlow1@outlook.com Reported by: stas@php.net Summary: crash on shutdown when destroying circular references in object Status: Assigned Type: Bug Package: Reproducible crash Operating System: MacOS X 10.6.6 PHP Version: 5.3SVN-2011-03-16 (snap) Assigned To: dmitry Block user comment: N Private report: N New Comment: The following pull request has been associated: Patch Name: breadcrumbs and next/prev links is now fixed as navbar On GitHub: https://github.com/php/web-php/pull/328 Patch: https://github.com/php/web-php/pull/328.patch Previous Comments: ------------------------------------------------------------------------ [2014-02-12 18:48:22] tyrael@php.net is this still valid? with 5.3 I still get a segfault, but with 5.4 and upwards the segfault doesn't occur. ------------------------------------------------------------------------ [2011-04-19 08:55:09] dmitry@php.net The crash occurs after memory overflow error detection, because some internal data structures were not completely initialized. It's probably possible to fix such initialization in a single place, but analysing each memory allocation in PHP code would take enormous time. I don't see a good may to fix such crashes. ------------------------------------------------------------------------ [2011-03-16 04:48:25] stas@php.net Description: ------------ Reported by Christian Holler on mailing list, the example code produces crash on engine shutdown. Test script: --------------- <?php class Person { public $dad; public function __destruct() { $this->dad = null; /* no segfault if this is commented out */ } } class Dad extends Person { public $son; public function __construct() { $this->son = new Person; $this->son->dad = $this; /* no segfault if this is commented out */ } public function __destruct() { $dad = new dad; parent::__destruct(); /* segfault here */ } } $o = new Dad; unset($o); echo "ok\n"; Actual result: -------------- Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_PROTECTION_FAILURE at address: 0x00000004 0x005310bd in gc_remove_from_buffer [inlined] () at /Users/smalyshev/php- src/branches/PHP_5_3/Zend/zend_gc.h:265 265 GC_REMOVE_FROM_BUFFER(root_buffer); (gdb) bt #0 0x005310bd in gc_remove_from_buffer [inlined] () at /Users/smalyshev/php- src/branches/PHP_5_3/Zend/zend_gc.h:265 #1 0x005310bd in gc_remove_zval_from_buffer (zv=0x2424dd8) at /Users/smalyshev/php-5.3/Zend/zend_gc.c:265 #2 0x004ffe56 in _zval_ptr_dtor (zval_ptr=0x2425154) at /Users/smalyshev/php- 5.3/Zend/zend_execute_API.c:442 #3 0x0051d7b7 in zend_hash_destroy (ht=0x24250f0) at /Users/smalyshev/php- 5.3/Zend/zend_hash.c:529 #4 0x00533700 in zend_object_std_dtor (object=0x24250c0) at /Users/smalyshev/php-5.3/Zend/zend_objects.c:45 #5 0x00533af0 in zend_objects_free_object_storage (object=0x24250c0) at /Users/smalyshev/php-5.3/Zend/zend_objects.c:126 #6 0x00538002 in zend_objects_store_free_object_storage (objects=0xa97d90) at /Users/smalyshev/php-5.3/Zend/zend_objects_API.c:92 #7 0x004ff84b in shutdown_executor () at /Users/smalyshev/php- 5.3/Zend/zend_execute_API.c:302 #8 0x0050fdf9 in zend_deactivate () at /Users/smalyshev/php-5.3/Zend/zend.c:890 #9 0x0049bea7 in php_request_shutdown (dummy=0x0) at /Users/smalyshev/php- 5.3/main/main.c:1635 #10 0x005d359f in main (argc=2, argv=0xbffff864) at /Users/smalyshev/php- 5.3/sapi/cli/php_cli.c:1374 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=54266&edit=1