Bug #81506 [NEW]: malloc(): unaligned tcache chunk detected

From: sjon Operating system: archLinux PHP version: 8.1.0RC3 Package: DOM XML related Bug Type: Bug Bug description:malloc(): unaligned tcache chunk detected Description: ------------ Found this while going through bughunt, see https://3v4l.org/N6CNZ it seems different from these two known issues #79451 and #80602 Test script: --------------- <?php $dom = null; $dt = null; $impl = null; function doThing() { $my_arr = []; global $dom,$dt,$impl; for($x = 0; $x < 7; $x++) { $dom = new \DOMDocument(); $dom->loadHTML("<!DOCTYPE html><p>hello</p>"); $impl = new \DOMImplementation(); $dt = $impl->createDocumentType("html", "", ""); array_push($my_arr, $dt, $dom, $impl); } $dom = new \DOMDocument(); $dom->loadHTML("<!DOCTYPE html><p>hello</p>"); $impl = new \DOMImplementation(); $dt = $impl->createDocumentType("html", "", ""); } //gc_collect_cycles(); doThing(); gc_collect_cycles(); $dom->replaceChild($dt, $dom->doctype); // FREE THE FIRST TIME! doThing(); // fill up tcache; coimment this out for tcache double free malding gc_collect_cycles(); // FREE AGAIN Expected result: ---------------- no segmentation fault Actual result: -------------- malloc(): unaligned tcache chunk detected Process exited with code 134. -- Edit bug report at https://bugs.php.net/bug.php?id=81506&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=81506&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=81506&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=81506&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=81506&r=needscript Try newer version: https://bugs.php.net/fix.php?id=81506&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=81506&r=support Expected behavior: https://bugs.php.net/fix.php?id=81506&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=81506&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=81506&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=81506&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=81506&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=81506&r=dst IIS Stability: https://bugs.php.net/fix.php?id=81506&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=81506&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=81506&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=81506&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=81506&r=mysqlcfg