Skip to content

zif_get_object_vars: Assertion `!(((__ht)->u.flags & (1<<2)) != 0)' failed. #10200

Closed
Closed
zif_get_object_vars: Assertion `!(((__ht)->u.flags & (1<<2)) != 0)' failed.#10200
Labels
BugExtension: standardStatus: Verified

Description

@Deltik
Deltik
opened on Jan 1, 2023

Description

The following code:

<?php

$xmlData = <<<EOF
<?xml version="1.0" encoding="utf-8"?>
<document>https://github.com/php/php-src/issues/10200 not encountered</document>
EOF;

$xml = simplexml_load_string($xmlData);
$output = get_object_vars($xml);
var_dump($output);

Resulted in this output:

php: /tmp/php-build/source/8.2.0/Zend/zend_builtin_functions.c:763: zif_get_object_vars: Assertion `!(((__ht)->u.flags & (1<<2)) != 0)' failed.
Aborted

But I expected this output instead:

array(1) {
  [0] =>
  string(59) "https://github.com/php/php-src/issues/10200 not encountered"
}

This bug affects PHP 8.2.0 but not PHP 8.1.13.

PHP 8.2.0 was compiled with the following configure options:

--enable-sockets
--enable-exif
--with-zlib
--with-zlib-dir=/usr
--with-bz2
--enable-intl
--with-openssl
--enable-soap
--enable-xmlreader
--with-xsl
--enable-ftp
--enable-cgi
--with-curl=/usr
--with-tidy
--enable-sysvsem
--enable-sysvshm
--enable-shmop
--with-mysqli=mysqlnd
--with-pdo-mysql=mysqlnd
--with-pdo-sqlite
--enable-pcntl
--with-readline
--enable-mbstring
--enable-debug
--enable-fpm
--enable-bcmath
--enable-phpdbg
--with-webp
--enable-gd
--with-jpeg
--with-zip
--with-mhash

PHP Version

PHP 8.2.0

Operating System

Ubuntu 22.04

Additional Information

Here's the line in the PHP source code where the assertion error happens:
https://github.com/php/php-src/blob/PHP-8.2.0/Zend/zend_builtin_functions.c#L763

Activity

  1. Deltik
    added
    Bug
    Status: Needs Triage
    on Jan 1, 2023

  2. ndossche commented on Jan 1, 2023

    @ndossche
    ndossche
    on Jan 1, 2023
    Member

    I analyzed this issue for a bit. I can confirm this happens on 8.2 and higher.

    The issue occurs because the summary element does not have attributes in your example, so the array of properties is just

    array(1) {
  [0]=>
  string(31) "Segmentation fault happens here"
}

    i.e. there is only an integer index here, so it's a packed hash table. But the code at that line 763 assumes it gets a non-packed hash table. Replacing ZEND_HASH_MAP_FOREACH_KEY_VAL by ZEND_HASH_FOREACH_KEY_VAL fixes the issue in this case I think. The error and the ZEND_HASH_MAP_FOREACH_KEY_VAL macro were introduced by 90b7bde, so I guess the assumption that there's a non-packed hash table does not hold at all the places where this replacement happened.

    Applying the following diff fixes this particular case, but there are probably more places where the following change needs to happen.

    diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
index 8813fa9788..5cebbbc560 100644
--- a/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@ -760,7 +760,7 @@ ZEND_FUNCTION(get_object_vars)
        } else {
                array_init_size(return_value, zend_hash_num_elements(properties));
 
-               ZEND_HASH_MAP_FOREACH_KEY_VAL(properties, num_key, key, value) {
+               ZEND_HASH_FOREACH_KEY_VAL(properties, num_key, key, value) {
                        bool is_dynamic = 1;
                        if (Z_TYPE_P(value) == IS_INDIRECT) {
                                value = Z_INDIRECT_P(value);

  3. Deltik commented on Jan 2, 2023

    @Deltik
    Deltik
    on Jan 2, 2023
    Author

    I updated my repro snippet with a much simpler one.

  4. Deltik
    added a commit that references this issue on Jan 2, 2023

    e107inc#4938: Workaround for PHP 8.2.0 segmentation fault / assertion…

    6b75f34
  5. ndossche
    added 2 commits that reference this issue on Jan 2, 2023

    Fix phpGH-10200: zif_get_object_vars: Assertion `!(((__ht)->u.flags &…

    609b0fc

    Add a regression test for phpGH-10200

    5e41fa1
  6. Girgias
    added a commit that references this issue on Jan 2, 2023

    Fix GH-10200: zif_get_object_vars: Assertion `!(((__ht)->u.flags & (1…

    c240491
  7. Girgias
    closed this as completedin a3d2c33on Jan 2, 2023
  8. cmb69
    added
    Extension: standard
    Status: Verified
    and removed
    Status: Needs Triage
    on Jan 5, 2023
  9. ndossche
    added a commit that references this issue on Jan 6, 2023

    Move test for phpGH-10200 to the simplexml extension test directory

    6717a7f
  10. Girgias
    added 2 commits that reference this issue on Jan 7, 2023

    Move test for GH-10200 to the simplexml extension test directory

    df96346

    Merge branch 'PHP-8.2'

    1b3e175
  11. ndossche
    added 2 commits that reference this issue on Mar 30, 2023

    Fix phpGH-10983: State-dependant segfault in ReflectionObject::getPro…

    70046fe

    Fix GH-10983: State-dependant segfault in ReflectionObject::getProper…

    dd29b66
  12. oerdnj
    added a commit that references this issue on Jul 8, 2026

    Fix phpGH-10200: zif_get_object_vars: Assertion `!(((__ht)->u.flags &…

    a3d2c33
  13. Deltik
    added a commit that references this issue on Jul 26, 2026

    #4938: Workaround for PHP 8.2.0 segmentation fault / assertion error

    0446307
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    BugExtension: standardStatus: Verified

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions