Bug #54266 [Asn->Fbk]: crash on shutdown when destroying circular references in object
Edit report at https://bugs.php.net/bug.php?id=54266&edit=1
ID: 54266
Updated by: cmb@php.net
Reported by: stas@php.net
Summary: crash on shutdown when destroying circular
references in object
-Status: Assigned
+Status: Feedback
Type: Bug
Package: Reproducible crash
Operating System: MacOS X 10.6.6
PHP Version: 5.3SVN-2011-03-16 (snap)
-Assigned To: dmitry
+Assigned To: cmb
Block user comment: N
Private report: N
New Comment:
> with 5.3 I still get a segfault, but with 5.4 and upwards the
> segfault doesn't occur.
Indeed, this appears to have been fixed long ago, or can anybody
still reproduce the crash with any of the actively supported PHP
versions[1]?
[1] <https://www.php.net/supported-versions.php>
Previous Comments:
------------------------------------------------------------------------
[2020-08-19 21:22:19] gfbarlow1 at outlook dot com
The following pull request has been associated:
Patch Name: breadcrumbs and next/prev links is now fixed as navbar
On GitHub: https://github.com/php/web-php/pull/328
Patch: https://github.com/php/web-php/pull/328.patch
------------------------------------------------------------------------
[2014-02-12 18:48:22] tyrael@php.net
is this still valid?
with 5.3 I still get a segfault, but with 5.4 and upwards the segfault doesn't occur.
------------------------------------------------------------------------
[2011-04-19 08:55:09] dmitry@php.net
The crash occurs after memory overflow error detection, because some internal data structures were
not completely initialized. It's probably possible to fix such initialization in a single
place, but analysing each memory allocation in PHP code would take enormous time.
I don't see a good may to fix such crashes.
------------------------------------------------------------------------
[2011-03-16 04:48:25] stas@php.net
Description:
------------
Reported by Christian Holler on mailing list, the example code produces crash on
engine shutdown.
Test script:
---------------
<?php
class Person {
public $dad;
public function __destruct() {
$this->dad = null; /* no segfault if this is commented out */
}
}
class Dad extends Person {
public $son;
public function __construct() {
$this->son = new Person;
$this->son->dad = $this; /* no segfault if this is commented out */
}
public function __destruct() {
$dad = new dad;
parent::__destruct(); /* segfault here */
}
}
$o = new Dad;
unset($o);
echo "ok\n";
Actual result:
--------------
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000004
0x005310bd in gc_remove_from_buffer [inlined] () at /Users/smalyshev/php-
src/branches/PHP_5_3/Zend/zend_gc.h:265
265 GC_REMOVE_FROM_BUFFER(root_buffer);
(gdb) bt
#0 0x005310bd in gc_remove_from_buffer [inlined] () at /Users/smalyshev/php-
src/branches/PHP_5_3/Zend/zend_gc.h:265
#1 0x005310bd in gc_remove_zval_from_buffer (zv=0x2424dd8) at
/Users/smalyshev/php-5.3/Zend/zend_gc.c:265
#2 0x004ffe56 in _zval_ptr_dtor (zval_ptr=0x2425154) at /Users/smalyshev/php-
5.3/Zend/zend_execute_API.c:442
#3 0x0051d7b7 in zend_hash_destroy (ht=0x24250f0) at /Users/smalyshev/php-
5.3/Zend/zend_hash.c:529
#4 0x00533700 in zend_object_std_dtor (object=0x24250c0) at
/Users/smalyshev/php-5.3/Zend/zend_objects.c:45
#5 0x00533af0 in zend_objects_free_object_storage (object=0x24250c0) at
/Users/smalyshev/php-5.3/Zend/zend_objects.c:126
#6 0x00538002 in zend_objects_store_free_object_storage (objects=0xa97d90) at
/Users/smalyshev/php-5.3/Zend/zend_objects_API.c:92
#7 0x004ff84b in shutdown_executor () at /Users/smalyshev/php-
5.3/Zend/zend_execute_API.c:302
#8 0x0050fdf9 in zend_deactivate () at /Users/smalyshev/php-5.3/Zend/zend.c:890
#9 0x0049bea7 in php_request_shutdown (dummy=0x0) at /Users/smalyshev/php-
5.3/main/main.c:1635
#10 0x005d359f in main (argc=2, argv=0xbffff864) at /Users/smalyshev/php-
5.3/sapi/cli/php_cli.c:1374
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=54266&edit=1
Thread (6 messages)