Bug #80081 [Opn]: Zend/zend_types.h:1164: zend_gc_delref: Assertion 'p->refcount > 0' fails

From: Date: Thu, 01 Oct 2020 09:44:12 +0000
Subject: Bug #80081 [Opn]: Zend/zend_types.h:1164: zend_gc_delref: Assertion 'p->refcount > 0' fails
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-229298@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=80081&edit=1

 ID:                 80081
 Updated by:         sjon@php.net
 Reported by:        sjon@php.net
 Summary:            Zend/zend_types.h:1164: zend_gc_delref: Assertion
                     'p->refcount > 0' fails
 Status:             Open
 Type:               Bug
 Package:            Reproducible crash
 Operating System:   archLinux
-PHP Version:        8.0.0beta3
+PHP Version:        8.0.0beta4
 Block user comment: N
 Private report:     N

 New Comment:

still happens in b4


Previous Comments:
------------------------------------------------------------------------
[2020-09-09 10:30:48] sjon@php.net

Description:
------------
occurs in a huge unittest. Although I can get a useful backtrace with dump_bt - getting a small
testcase proves difficult

Test script:
---------------
<?php

class l implements IteratorAggregate
{
    public function getIterator()
    {
        while (preg_match(self::$_regex[static::class][$this->_state], $this->_input,
$matches, 0, $this->_offset))
        {
            $n = $v = end($matches);
            $action = self::$_mapping[static::class][$this->_state][key($matches)];
            $this->_offset += strlen($v);
            $p = $this->_offset;

            # apparently cause
            $token = array(static::$_tokens[$this->_state][$n], $v); 

            yield $p => $token;
        }
    }
}


Actual result:
--------------
#0  0x00007ffff764c615 in raise () from /usr/lib/libc.so.6
#1  0x00007ffff7635862 in abort () from /usr/lib/libc.so.6
#2  0x00007ffff7635747 in __assert_fail_base.cold () from /usr/lib/libc.so.6
#3  0x00007ffff7644bf6 in __assert_fail () from /usr/lib/libc.so.6
#4  0x0000555555c659ae in zend_gc_delref (p=0x7fffef0cbba0) 
    at Zend/zend_types.h:1164
#5  0x0000555555c66b6d in gc_mark_grey (ref=0x7fffef0cbba0, stack=0x7fffffff9800)
    at Zend/zend_gc.c:853
#6  0x0000555555c67025 in gc_mark_roots (stack=0x7fffffff9800)
    at Zend/zend_gc.c:979
#7  0x0000555555c681ea in zend_gc_collect_cycles ()
    at Zend/zend_gc.c:1464
#8  0x0000555555c661b8 in gc_possible_root_when_full (ref=0x7fffef0c79c0)
    at Zend/zend_gc.c:592
#9  0x0000555555c66339 in gc_possible_root (ref=0x7fffef0c79c0)
    at Zend/zend_gc.c:642
#10 0x0000555555bcfeda in zend_assign_to_variable (variable_ptr=0x7ffff015b3a0,
value=0x7ffff015b5c0, value_type=2 '\002', strict=false)
    at Zend/zend_execute.h:147
#11 0x0000555555c447bb in ZEND_ASSIGN_SPEC_CV_TMP_RETVAL_UNUSED_HANDLER ()
    at Zend/zend_vm_execute.h:46509
#12 0x0000555555c541ed in execute_ex (ex=0x7ffff015b300)
    at Zend/zend_vm_execute.h:59473
#13 0x0000555555c72b8d in zend_generator_resume (orig_generator=0x7fffef0904c0)
    at Zend/zend_generators.c:779
#14 0x0000555555c73d35 in zend_generator_iterator_move_forward (iterator=0x7ffff216b480)
    at Zend/zend_generators.c:1100
#15 0x0000555555c0fe94 in ZEND_FE_FETCH_R_SPEC_VAR_HANDLER ()
    at Zend/zend_vm_execute.h:22266
#16 0x0000555555c524a6 in execute_ex (ex=0x7ffff5415020)
    at Zend/zend_vm_execute.h:57729
#17 0x0000555555c5492a in zend_execute (op_array=0x7ffff545e280, return_value=0x0)
    at Zend/zend_vm_execute.h:59932
#18 0x0000555555ba6b45 in zend_execute_scripts (type=8, retval=0x0, file_count=3)
    at Zend/zend.c:1697
#19 0x0000555555b08c14 in php_execute_script (primary_file=0x7fffffffd430)
    at main/main.c:2500
#20 0x0000555555c93f17 in do_cli (argc=9, argv=0x55555698f690)
    at sapi/cli/php_cli.c:949
#21 0x0000555555c94f8e in main (argc=9, argv=0x55555698f690)
    at sapi/cli/php_cli.c:1336



------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=80081&edit=1

Thread (4 messages)

« previous php.bugs (#229298) next »