Bug #81514 [Opn->Ver]: Using Enum as key in WeakMap triggers GC + SegFault

Edit report at https://bugs.php.net/bug.php?id=81514&edit=1 ID: 81514 Updated by: nikic@php.net Reported by: james at lucas dot net dot au Summary: Using Enum as key in WeakMap triggers GC + SegFault -Status: Open +Status: Verified Type: Bug Package: Reproducible crash Operating System: MacOS/Linux PHP Version: 8.1.0RC3 Block user comment: N Private report: N Previous Comments: ------------------------------------------------------------------------ [2021-10-08 04:25:12] james at lucas dot net dot au Description: ------------ Enum keys in WeakMaps are Garbage collected after first retrieval (via offsetGet or foreach) which should not occur as they are singletons (per https://wiki.php.net/rfc/enumerations#splobjectstorage_and_weakmaps). After the Enum is gone from the WeakMap an additional offsetGet for the Enum key triggers a Segfault instead of Object TestEnum#1 not contained in WeakMap. This does not occur when using plain objects Test script: --------------- <?php declare(strict_types=1); echo 'WeakMap with object as key' . PHP_EOL; $map = new WeakMap(); $obj1 = new stdClass(); $map->offsetSet($obj1, 'string'); echo 'Map contains ' . count($map) . ' objects' . PHP_EOL; $map->offsetGet($obj1); echo 'Map contains ' . count($map) . ' objects' . PHP_EOL . PHP_EOL; $map->offsetGet($obj1); echo 'WeakMap with Enum as key' . PHP_EOL; enum TestEnum { case A; } $map = new WeakMap(); $map->offsetSet(TestEnum::A, 'a string'); echo 'Map contains ' . count($map) . ' objects' . PHP_EOL; $map->offsetGet(TestEnum::A); echo 'Map contains ' . count($map) . ' objects' . PHP_EOL . PHP_EOL; // <-- Map will no longer contain ENUM $map->offsetGet(TestEnum::A); // <-- Segfault Here echo "done"; Expected result: ---------------- WeakMap with object as key Map contains 1 objects Map contains 1 objects WeakMap with Enum as key Map contains 1 objects Map contains 1 objects done Actual result: -------------- WeakMap with object as key Map contains 1 objects Map contains 1 objects WeakMap with Enum as key Map contains 1 objects Map contains 0 objects Segmentation fault: 11 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=81514&edit=1