Bug #81506 [Opn->Csd]: malloc(): unaligned tcache chunk detected

Edit report at https://bugs.php.net/bug.php?id=81506&edit=1 ID: 81506 Updated by: nielsdos@php.net Reported by: sjon@php.net Summary: malloc(): unaligned tcache chunk detected -Status: Open +Status: Closed Type: Bug Package: DOM XML related Operating System: archLinux PHP Version: 8.1.0RC3 -Assigned To: +Assigned To: nielsdos Block user comment: N Private report: N New Comment: Thank you for your bug report. This issue has already been fixed in the latest released version of PHP, which you can download at http://www.php.net/downloads.php This was fixed in 8.0.24, 8.1.11 and 8.2.0, but the issue wasn't yet closed. Previous Comments: ------------------------------------------------------------------------ [2021-10-05 13:45:09] sjon@php.net Description: ------------ Found this while going through bughunt, see https://3v4l.org/N6CNZ it seems different from these two known issues #79451 and #80602 Test script: --------------- <?php $dom = null; $dt = null; $impl = null; function doThing() { $my_arr = []; global $dom,$dt,$impl; for($x = 0; $x < 7; $x++) { $dom = new \DOMDocument(); $dom->loadHTML("<!DOCTYPE html><p>hello</p>"); $impl = new \DOMImplementation(); $dt = $impl->createDocumentType("html", "", ""); array_push($my_arr, $dt, $dom, $impl); } $dom = new \DOMDocument(); $dom->loadHTML("<!DOCTYPE html><p>hello</p>"); $impl = new \DOMImplementation(); $dt = $impl->createDocumentType("html", "", ""); } //gc_collect_cycles(); doThing(); gc_collect_cycles(); $dom->replaceChild($dt, $dom->doctype); // FREE THE FIRST TIME! doThing(); // fill up tcache; coimment this out for tcache double free malding gc_collect_cycles(); // FREE AGAIN Expected result: ---------------- no segmentation fault Actual result: -------------- malloc(): unaligned tcache chunk detected Process exited with code 134. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=81506&edit=1