Bug #78647 [Asn->Csd]: SEGFAULT in zend_do_perform_implementation_check

Edit report at https://bugs.php.net/bug.php?id=78647&edit=1 ID: 78647 Updated by: git@php.net Reported by: leigh@php.net Summary: SEGFAULT in zend_do_perform_implementation_check -Status: Assigned +Status: Closed Type: Bug Package: Reproducible crash Operating System: Linux PHP Version: master-Git-2019-10-08 (Git) Assigned To: nikic Block user comment: N Private report: N New Comment: Automatic comment on behalf of nikic Revision: https://github.com/php/php-src/commit/a38f4f9881789a45a1466939b3b76143d00af849 Log: Fix bug #78647 Previous Comments: ------------------------------------------------------------------------ [2019-10-08 13:24:18] nikic@php.net This particular test script should generate a compile error because class X cannot be loaded but is needed for variance verification. Here is a variant that fails with the same assertion but should compile file: <?php spl_autoload_register(function ($class) { if ($class == 'A') { class A { function m(): B {} function m2(): B {} } } elseif ($class == 'B') { class B extends A { function m(): X {} function m2(): Y {} } } elseif ($class == 'X') { class X extends B {} } else { class Y extends B {} } }); new B; ------------------------------------------------------------------------ [2019-10-08 12:31:00] leigh@php.net Description: ------------ Present in PHP-7.4 / master branches but not PHP-7.3 branch. Compiled with --disable-all. Found using AFL. Debug build hits the assertion in report_variance_errors with: Assertion `obligation->type == OBLIGATION_COMPATIBILITY' failed. Test script: --------------- <?php spl_autoload_register(function ($class) { if ($class == 'A') { class A { function m(): B {} } } elseif ($class == 'B') { class B extends A { function m(): X {} } } else { class C extends B {} } }); new B; Expected result: ---------------- Exit code 0 Actual result: -------------- Program received signal SIGSEGV, Segmentation fault. zend_do_perform_implementation_check (unresolved_class=unresolved_class@entry=0x7fffffff9ad0, fe=0x0, proto=0x7ffff7a033b0) at /home/leigh/php-src/Zend/zend_inheritance.c:418 418 ZEND_ASSERT(!((fe->common.fn_flags & ZEND_ACC_CTOR) (gdb) bt #0 zend_do_perform_implementation_check (unresolved_class=unresolved_class@entry=0x7fffffff9ad0, fe=0x0, proto=0x7ffff7a033b0) at /home/leigh/php-src/Zend/zend_inheritance.c:418 #1 0x000055555597af9e in report_variance_errors (ce=0x7ffff7a03660) at /home/leigh/php-src/Zend/zend_inheritance.c:2268 #2 zend_do_link_class (ce=ce@entry=0x7ffff7a03660, lc_parent_name=lc_parent_name@entry=0x55555617dfb0) at /home/leigh/php-src/Zend/zend_inheritance.c:2369 #3 0x0000555555923ef2 in do_bind_class (lcname=0x7ffff7a6d1e0, lc_parent_name=0x55555617dfb0) at /home/leigh/php-src/Zend/zend_compile.c:1076 #4 0x000055555598d155 in ZEND_DECLARE_CLASS_SPEC_CONST_HANDLER () at /home/leigh/php-src/Zend/zend_vm_execute.h:4342 #5 0x00005555559be1e3 in execute_ex (ex=0x7fffffff9ad0) at /home/leigh/php-src/Zend/zend_vm_execute.h:54252 #6 0x00005555559361f9 in zend_call_function (fci=fci@entry=0x7fffffff9d30, fci_cache=0x7ffff7a6d120, fci_cache@entry=0x7fffffff9d10) at /home/leigh/php-src/Zend/zend_execute_API.c:784 #7 0x00005555558426bc in zif_spl_autoload_call (execute_data=<optimised out>, return_value=<optimised out>) at /home/leigh/php-src/ext/spl/php_spl.c:450 #8 0x0000555555935ff7 in zend_call_function (fci=0x7fffffff9eb0, fci_cache=0x7fffffff9e90) at /home/leigh/php-src/Zend/zend_execute_API.c:799 #9 0x00005555559366f3 in zend_lookup_class_ex (name=<optimised out>, key=key@entry=0x0, flags=flags@entry=0) at /home/leigh/php-src/Zend/zend_execute_API.c:935 #10 0x00005555559368d9 in zend_lookup_class (name=<optimised out>) at /home/leigh/php-src/Zend/zend_execute_API.c:956 #11 0x000055555597aed7 in load_delayed_classes () at /home/leigh/php-src/Zend/zend_inheritance.c:2228 #12 zend_do_link_class (ce=ce@entry=0x7ffff7a033b0, lc_parent_name=lc_parent_name@entry=0x55555617df80) at /home/leigh/php-src/Zend/zend_inheritance.c:2365 #13 0x0000555555923ef2 in do_bind_class (lcname=0x7ffff7a6d1b0, lc_parent_name=0x55555617df80) at /home/leigh/php-src/Zend/zend_compile.c:1076 #14 0x000055555598d155 in ZEND_DECLARE_CLASS_SPEC_CONST_HANDLER () at /home/leigh/php-src/Zend/zend_vm_execute.h:4342 #15 0x00005555559be1e3 in execute_ex (ex=0x7fffffff9ad0) at /home/leigh/php-src/Zend/zend_vm_execute.h:54252 #16 0x00005555559361f9 in zend_call_function (fci=fci@entry=0x7fffffffa210, fci_cache=0x7ffff7a6d0e0, fci_cache@entry=0x7fffffffa1f0) at /home/leigh/php-src/Zend/zend_execute_API.c:784 #17 0x00005555558426bc in zif_spl_autoload_call (execute_data=<optimised out>, return_value=<optimised out>) at /home/leigh/php-src/ext/spl/php_spl.c:450 #18 0x0000555555935ff7 in zend_call_function (fci=0x7fffffffa390, fci_cache=0x7fffffffa370) at /home/leigh/php-src/Zend/zend_execute_API.c:799 #19 0x00005555559366f3 in zend_lookup_class_ex (name=name@entry=0x55555617d9b0, key=0x55555617dfb0, flags=flags@entry=512) at /home/leigh/php-src/Zend/zend_execute_API.c:935 #20 0x0000555555936f7c in zend_fetch_class_by_name (class_name=0x55555617d9b0, key=<optimised out>, fetch_type=fetch_type@entry=512) at /home/leigh/php-src/Zend/zend_execute_API.c:1365 #21 0x00005555559a4d77 in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at /home/leigh/php-src/Zend/zend_vm_execute.h:9116 #22 0x00005555559be07b in execute_ex (ex=0x7fffffff9ad0) at /home/leigh/php-src/Zend/zend_vm_execute.h:54692 #23 0x00005555559c4f4d in zend_execute (op_array=0x7ffff7a802a0, return_value=<optimised out>) at /home/leigh/php-src/Zend/zend_vm_execute.h:58019 #24 0x00005555559437b1 in zend_execute_scripts (type=type@entry=8, retval=0x7ffff7a82200, retval@entry=0x0, file_count=file_count@entry=3) at /home/leigh/php-src/Zend/zend.c:1643 #25 0x00005555558e5780 in php_execute_script (primary_file=<optimised out>) at /home/leigh/php-src/main/main.c:2585 #26 0x00005555559c6f6c in do_cli (argc=2, argv=0x555556172860) at /home/leigh/php-src/sapi/cli/php_cli.c:959 #27 0x000055555577e78d in main (argc=2, argv=0x555556172860) at /home/leigh/php-src/sapi/cli/php_cli.c:1350 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78647&edit=1