Bug #81558 [Asn->Dup]: Extension with observer segfaults when attribute is instantiated

Edit report at https://bugs.php.net/bug.php?id=81558&edit=1 ID: 81558 Updated by: bwoebi@php.net Reported by: beberlei@php.net Summary: Extension with observer segfaults when attribute is instantiated -Status: Assigned +Status: Duplicate Type: Bug Package: *General Issues Operating System: Linux PHP Version: 8.0.12 Assigned To: bwoebi Block user comment: N Private report: N New Comment: Duplicate of #81430 Previous Comments: ------------------------------------------------------------------------ [2021-10-27 11:42:12] beberlei@php.net Description: ------------ An extension registering an observer will lead to a segfault in zend_observer_fcall_end for ReflectionAttribute::newInstance. Stacktrace is: Program received signal SIGSEGV, Segmentation fault. 0x0000555555d9dc07 in zend_observer_fcall_end (execute_data=0x7ffff46151a0, return_value=0x7fffffff8c80) at /home/benny/code/projects/php/php-src/Zend/zend_observer.c:232 232 || !ZEND_OBSERVER_DATA(&ex->func->op_array) (gdb) bt #0 0x0000555555d9dc07 in zend_observer_fcall_end (execute_data=0x7ffff46151a0, return_value=0x7fffffff8c80) at /home/benny/code/projects/php/php-src/Zend/zend_observer.c:232 #1 0x0000555555d59c15 in execute_ex (ex=0x7ffff46151a0) at /home/benny/code/projects/php/php-src/Zend/zend_vm_execute.h:54537 #2 0x0000555555c9740c in zend_call_function (fci=0x7fffffff8cb0, fci_cache=0x7fffffff8c90) at /home/benny/code/projects/php/php-src/Zend/zend_execute_API.c:895 #3 0x0000555555c977ba in zend_call_known_function (fn=0x7ffff46041e8, object=0x7ffff46ce600, called_scope=0x7ffff4604018, retval_ptr=0x0, param_count=0, params=0x7ffff46662d0, named_params=0x7ffff46ce360) at /home/benny/code/projects/php/php-src/Zend/zend_execute_API.c:985 #4 0x0000555555a3d965 in call_attribute_constructor (attr=0x7ffff469a7e0, ce=0x7ffff4604018, obj=0x7ffff46ce600, args=0x7ffff46662d0, argc=0, named_params=0x7ffff46ce360, filename=0x7ffff4603640) at /home/benny/code/projects/php/php-src/ext/reflection/php_reflection.c:6326 #5 0x0000555555a3e11e in zim_ReflectionAttribute_newInstance (execute_data=0x7ffff4615150, return_value=0x7ffff4615100) at /home/benny/code/projects/php/php-src/ext/reflection/php_reflection.c:6454 #6 0x0000555555ce2625 in execute_internal (execute_data=0x7ffff4615150, return_value=0x7ffff4615100) at /home/benny/code/projects/php/php-src/Zend/zend_execute.c:3414 #7 0x00007ffff4977a88 in tideways_execute_internal () from /home/benny/tideways/workspace/github.com/tideways/php-extension-next/modules/tideways.so #8 0x0000555555ce9e33 in ZEND_DO_FCALL_SPEC_OBSERVER_HANDLER () at /home/benny/code/projects/php/php-src/Zend/zend_vm_execute.h:1973 #9 0x0000555555d59325 in execute_ex (ex=0x7ffff4615020) at /home/benny/code/projects/php/php-src/Zend/zend_vm_execute.h:54213 #10 0x0000555555d5ea5e in zend_execute (op_array=0x7ffff4660280, return_value=0x0) at /home/benny/code/projects/php/php-src/Zend/zend_vm_execute.h:58524 #11 0x0000555555caf3c5 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/benny/code/projects/php/php-src/Zend/zend.c:1680 #12 0x0000555555c10d34 in php_execute_script (primary_file=0x7fffffffb840) at /home/benny/code/projects/php/php-src/main/main.c:2539 #13 0x0000555555d9fb49 in do_cli (argc=96, argv=0x555556dc11c0) at /home/benny/code/projects/php/php-src/sapi/cli/php_cli.c:949 #14 0x0000555555da0b96 in main (argc=96, argv=0x555556dc11c0) at /home/benny/code/projects/php/php-src/sapi/cli/php_cli.c:1337 Could not reproduce this on the script with "zend_test", but it does for our own observer. Will put more work into getting a reproduce on zend_test. More stacktraces from a larger app crashing: https://gist.github.com/beberlei/5bde1ea06f7dd4bfb42cf158c5779405 Test script: --------------- <?php #[Attribute] class Entity { public function __construct( private $table, ) {} } #[Entity(table: "product")] class Product { } $reflectionClass = new \ReflectionClass('Product'); $entity = $reflectionClass->getAttributes()[0]->newInstance(); ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=81558&edit=1