Bug #11218 Updated: isset() inside for() loops can crash

ID: 11218 User Update by: danielc@analysisandsolutions.com Old-Status: Feedback Status: Open Bug Type: Scripting Engine problem Operating system: NT 4.0 SP6a PHP Version: 4.0.5 Description: isset() inside for() loops can crash Tested latest snapshot, http://www.zend.com/snapshots/get_latest.php, as of 17:00 -400. The problem with isset() inside for loops is fixed. BUT, there is still a problem. Testing a multidimensional array when only one dimension of the array is set causes the test to come out true even when it is not. See example: <?php # http://bugs.php.net/?id=11218 # # This "if isset()" test comes out as true # even though it's actually false. echo 'Should not see anything else after this...'; $Var['SC'] = 'y'; if ( isset($Var['SC']['hide']) ) { echo "<br />isset() says \$Var['SC']['hide'] is set."; } ?> PS: I'm saddened to hear new versions of PHP are going out with unresolved bugs in functions as basic and essential as isset(). Previous Comments: --------------------------------------------------------------------------- [2001-06-21 12:14:07] zeev@php.net I was unable to reproduce that problem, however, I did fix bug #10911 which appears to be based on the same issue. Can you please test the latest CVS and see whether it solves your problem (note, this fix may not be a part of 4.0.6, since 4.0.6 has already been packaged; It'll definitely be in 4.0.7) --------------------------------------------------------------------------- [2001-06-05 17:20:08] danielc@analysisandsolutions.com Bug 10911, http://www.php.net/bugs.php?id=10911, was brought to my attention. Both my report above and this other one may be based on the same bug. --------------------------------------------------------------------------- [2001-05-31 12:33:40] danielc@analysisandsolutions.com <?php # The problem child... function Test($FileName, $FileLine, $Opt='', $Col='') { for ($Counter = 0; $Counter < 3; $Counter++) { echo '<br />in for '; if ( isset($Col['SC']['hide']) ) { echo 'in if'; } } } Test(__FILE__,__LINE__); # NOW, funny things happen if I change the number of times # the for loop runs... # $Counter < 1... # Everything is fine. # $Counter < 2... # Dr Watson notifys of PHP crash, hit OK # (SeeDr Watson report at end of this posting.) # Text is displayed in browser. # PHP no longer running. # $Counter < 3... # Nothing returned to browser. # No Dr Watson reports. # PHP won't stop executing, takes up 99% of processor time. # Can't "End Process" in Task Manger. # Doesn't stop after max execution time. # Need to reboot to kill PHP process. # # Though, if I execute from command line... # winds up in same infinite loop, but I can # kill the PHP process from the task manager. # So, if that's not strange enough, altering the # test code in small ways eliminates the problem... # remove if / isset segment... # okay /* function Test($FileName, $FileLine, $Opt='', $Col='') { for ($Counter = 0; $Counter < 3; $Counter++) { echo '<br />in for '; } } Test(__FILE__,__LINE__); */ # put the if / isset segment back # BUT remove the for loop.... # okay /* function Test($FileName, $FileLine, $Opt='', $Col='') { if ( isset($Col['SC']['hide']) ) { echo 'in if'; } } Test(__FILE__,__LINE__); */ # put the for loop back # BUT do isset on a single dimensional array... # okay /* function Test($FileName, $FileLine, $Opt='', $Col='') { for ($Counter = 0; $Counter < 3; $Counter++) { echo '<br />in for '; if ( isset($Col['SC']) ) { echo 'in if'; } } } Test(__FILE__,__LINE__); */ # perform tasks outside a function. # okay /* for ($Counter = 0; $Counter < 3; $Counter++) { echo '<br />in for '; if ( isset($Col['SC']['hide']) ) { echo 'in if'; } } */ # set the array before running function # okay /* $Var['SC']['hide'] = 'y'; function Test($FileName, $FileLine, $Opt='', $Col='') { for ($Counter = 0; $Counter < 3; $Counter++) { echo '<br />in for '; if ( isset($Col['SC']['hide']) ) { echo 'in if'; } } } Test(__FILE__,__LINE__,'',$Var); */ # Set a single dimensional array, # though continue to perform isset on a two dimensional # Doesn't crash # --> _BUT_ the "if isset()" test comes out as TRUE # --> even when it's actually FALSE! /* unset($Var); $Var['SC'] = 'y'; function Test($FileName, $FileLine, $Opt='', $Col='') { for ($Counter = 0; $Counter < 3; $Counter++) { echo '<br />in for '; if ( isset($Col['SC']['hide']) ) { echo 'in if'; } } } Test(__FILE__,__LINE__,'',$Var); */ # Set variable to a string... # okay /* $Var = 'y'; function Test($FileName, $FileLine, $Opt='', $Col='') { for ($Counter = 0; $Counter < 3; $Counter++) { echo '<br />in for '; if ( isset($Col['SC']['hide']) ) { echo 'in if'; } } } Test(__FILE__,__LINE__,'',$Var); */ /* Application exception occurred: App: (pid=212) When: 5/31/2001 @ 11:59:23.314 Exception number: c0000005 (access violation) *----> System Information <----* Computer Name: BASE User Name: SYSTEM Number of Processors: 1 Processor Type: x86 Family 6 Model 3 Stepping 4 Windows Version: 4.0 Current Build: 1381 Service Pack: 6 Current Type: Uniprocessor Free Registered Organization: Analysis and Solutions Company Registered Owner: Daniel Convissor *----> Task List <----* 0 Idle.exe 2 System.exe 20 SMSS.exe 24 CSRSS.exe 34 winlogon.exe 40 SERVICES.exe 43 LSASS.exe 66 SPOOLSS.exe 73 Apache.exe 80 mysqld-nt.exe 82 Apache.exe 137 RPCSS.exe 153 vsmon.exe 165 minilog.exe 189 NDDEAGNT.exe 42 EXPLORER.exe 186 LOADWC.exe 166 zonealarm.exe 182 NOTEPAD.exe 183 netscape.exe 212 php.exe 218 DRWTSN32.exe 0 _Total.exe (00400000 - 00400000) (77f60000 - 77fbe000) dllntdll.dbg (10000000 - 10000000) (77f00000 - 77f5e000) dllkernel32.dbg (77e70000 - 77ec5000) dlluser32.dbg (77ed0000 - 77efc000) dllgdi32.dbg (77dc0000 - 77dff000) dlladvapi32.dbg (77e10000 - 77e67000) dllrpcrt4.dbg (776d0000 - 776d8000) dllwsock32.dbg (776b0000 - 776c4000) dllws2_32.dbg (78000000 - 78046000) (776a0000 - 776a7000) dllws2help.dbg (77b20000 - 77bd7000) dllole32.dbg (65340000 - 653d2000) oleaut32.dbg (04a50000 - 04a8c000) odbc32.DBG (71700000 - 7178a000) COMCTL32.dbg (77c40000 - 77d7c000) dllshell32.dbg (77d80000 - 77db2000) dllcomdlg32.dbg (77a90000 - 77a9b000) dllversion.dbg (779c0000 - 779c8000) dlllz32.dbg (780a0000 - 780b2000) (04a00000 - 04a00000) State Dump for Thread Id 0xd7 eax=00570720 ebx=00536d70 ecx=0000005b edx=00000000 esi=00570300 edi=00536d70 eip=1008999a esp=0012fe7c ebp=00000004 iopl=0 nv up ei pl zr na po nc cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246 function: <nosymbols> 10089983 eb17 jmp 1008999c 10089985 85c0 test eax,eax 10089987 740c jz 10089995 10089989 3b7704 cmp esi,[edi+0x4] ds:01455776=???????? 1008998c 7507 jnz 10089995 1008998e 8b0e mov ecx,[esi] ds:00570300=00570720 10089990 894f04 mov [edi+0x4],ecx ds:01455776=???????? 10089993 eb07 jmp 1008999c 10089995 8b5604 mov edx,[esi+0x4] ds:0148ed06=???????? 10089998 8b06 mov eax,[esi] ds:00570300=00570720 FAULT ->1008999a 8902 mov [edx],eax ds:00000000=???????? 1008999c 8b06 mov eax,[esi] ds:00570300=00570720 1008999e 85c0 test eax,eax 100899a0 7406 jz 100899a8 100899a2 8b4e04 mov ecx,[esi+0x4] ds:0148ed06=???????? 100899a5 894804 mov [eax+0x4],ecx ds:0148f126=???????? 100899a8 a1688c0f10 mov eax,[100f8c68] ds:100f8c68=00000000 100899ad 85c0 test eax,eax 100899af 745c jz 10089a0d 100899b1 ffd0 call eax 100899b3 5f pop edi 100899b4 5e pop esi *----> Stack Back Trace <----* FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name 00000004 00000000 00000000 00000000 00000000 00000000 <nosymbols> *----> Raw Stack Dump <----* 0012fe7c a4 99 53 00 10 03 57 00 - 5f 9d 08 10 10 03 57 00 ..S...W._.....W. 0012fe8c 34 42 02 78 54 13 54 00 - bc fe 12 00 01 00 00 00 4B.xT.T......... 0012fe9c 33 27 00 10 00 00 00 00 - 00 00 00 00 20 00 54 00 3'.......... .T. 0012feac c0 17 54 00 20 00 54 00 - f0 32 54 00 20 12 54 00 ..T. .T..2T. .T. 0012febc 4c ff 12 00 bf 1a 40 00 - 00 00 00 00 00 00 00 00 L.....@......... 0012fecc 00 00 00 00 00 f0 fd 7f - 00 00 00 00 00 00 00 00 ................ 0012fedc 04 00 00 00 00 00 00 00 - 00 cd 00 78 e8 3c 13 00 ...........x.<.. 0012feec 40 ce 03 78 00 f0 fd 7f - 1d 00 00 00 90 02 54 00 @..x..........T. 0012fefc 34 ff 12 00 03 6f f6 77 - 60 04 57 00 00 00 00 00 4....o.w`.W..... 0012ff0c 30 03 57 00 00 ff ff ff - 00 00 00 00 01 00 00 00 0.W............. 0012ff1c 00 00 00 00 01 00 00 00 - 90 02 54 00 00 f0 fd 7f ..........T..... 0012ff2c 00 00 00 00 20 00 54 00 - 20 12 54 00 f0 32 54 00 .... .T. .T..2T. 0012ff3c 01 00 00 00 00 00 00 00 - 00 00 00 00 c0 17 54 00 ..............T. 0012ff4c c0 ff 12 00 cb 20 40 00 - 01 00 00 00 90 02 54 00 ..... @.......T. 0012ff5c 90 0c 54 00 00 40 40 00 - 04 40 40 00 a4 ff 12 00 ..T..@@..@@..... 0012ff6c 94 ff 12 00 a0 ff 12 00 - 00 00 00 00 98 ff 12 00 ................ 0012ff7c 08 40 40 00 0c 40 40 00 - 00 00 00 00 00 00 00 00 .@@..@@......... 0012ff8c 00 f0 fd 7f 05 00 00 c0 - 90 02 54 00 00 00 00 00 ..........T..... 0012ff9c a1 c2 11 80 90 0c 54 00 - 01 00 00 00 84 ff 12 00 ......T......... 0012ffac c4 fc 12 00 e0 ff 12 00 - 20 21 40 00 50 31 40 00 ........ !@.P1@. State Dump for Thread Id 0xd5 eax=00007530 ebx=00000000 ecx=000000d7 edx=00000000 esi=77e726e5 edi=00c5ff6c eip=77e72397 esp=00c5ff24 ebp=00c5ff48 iopl=0 nv up ei pl zr na po nc cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246 function: InvalidateRect 77e7237e b89e110000 mov eax,0x119e 77e72383 8d542404 lea edx,[esp+0x4] ss:01b7e92b=???????? 77e72387 cd2e int 2e 77e72389 c20c00 ret 0xc 77e7238c b885110000 mov eax,0x1185 77e72391 8d542404 lea edx,[esp+0x4] ss:01b7e92b=???????? 77e72395 cd2e int 2e 77e72397 c21400 ret 0x14 *----> Stack Back Trace <----* FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name 00c5ff48 10093e95 00c5ff6c 00000000 00000000 00000000 user32!InvalidateRect */ ?> --------------------------------------------------------------------------- The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online. Full Bug description available at: http://bugs.php.net/?id=11218