Bug #14833: Crash with referense in bogus code

From: sitnikov@infonet.ee Operating system: Linux PHP version: 4.1.1 PHP Bug Type: Reproducible crash Bug description: Crash with referense in bogus code <? function &foo(&$str) { //$str = str_replace("a", "b", $str); // line * return $str; } echo $str = &foo($str = "aaaaaaaaa"); ?> If uncommect line *, we not have 'Segmentation', but have unpredictable behavior. P.S. I know that it bogus code (gdb) run -f 1.php Starting program: php -f ~/public_html/test/1.php Program received signal SIGSEGV, Segmentation fault. chunk_free (ar_ptr=0x4060adc0, p=0x82dc080) at malloc.c:3049 3049 malloc.c: No such file or directory. in malloc.c (gdb) bt #0 chunk_free (ar_ptr=0x4060adc0, p=0x82dc080) at malloc.c:3049 #1 0x40575f9a in __libc_free (mem=0x82dc088) at malloc.c:3023 #2 0x080c800b in _efree (ptr=0x82dc094) at zend_alloc.c:246 #3 0x080c84a1 in shutdown_memory_manager (silent=1, clean_cache=0) at zend_alloc.c:469 #4 0x080772e4 in php_request_shutdown (dummy=0x0) at main.c:742 #5 0x080737ef in main (argc=3, argv=0xbffff9a4) at cgi_main.c:776 #6 0x405349cb in __libc_start_main (main=0x8072ebc <main>, argc=3, argv=0xbffff9a4, init=0x806ffa8 <_init>, fini=0x81b1ff0 <_fini>, rtld_fini=0x4000aea0 <_dl_fini>, stack_end=0xbffff99c) at ../sysdeps/generic/libc-start.c:92 -- Edit bug report at: http://bugs.php.net/?id=14833&edit=1