Repository navigation
Segmentation fault: some combination of array operations, first-class callable, exception handler and autoloader #14003
Description
Description
The following code:
<?php
set_exception_handler(function (\Throwable $e) {
new NonExistentClass();
});
function foo(string $key): string
{
throw new \Exception('asdas');
}
$validKeys = array_keys(
array_filter(
[
'a' => 'b',
],
),
);
$result = array_filter(
array_combine(
$validKeys,
array_map(foo(...), $validKeys),
),
);results in segmentation fault (https://3v4l.org/ZoXRO). This example is as minimal as I was able to get. Here are some random things that fix the segmentation fault (any one of these is enough):
- Changing
foo(...)to'foo'. - Removing either of the
array_filters (i.e. replace it with its argument). - Removing the
array_combine(i.e. replace it with thearray_map). - Not loading the
NonExistentClassin the exception handler (the point of the NonExistentClass is to call the autoloader, if the instantiated class is already loaded, then the segfault doesn't happen either).
Here is a backtrace:
(gdb) bt
#0 zend_mm_alloc_small (bin_num=6, heap=0x701fcc600040) at /usr/src/debug/php/php-8.3.6/Zend/zend_alloc.c:1312
#1 _emalloc_56 () at /usr/src/debug/php/php-8.3.6/Zend/zend_alloc.c:2542
#2 _zend_new_array_0 () at /usr/src/debug/php/php-8.3.6/Zend/zend_hash.c:284
#3 0x0000592f9ecfb8b9 in zend_fetch_debug_backtrace (return_value=0x7ffdf7951bf0, skip_last=<optimized out>, options=2, limit=0)
at /usr/src/debug/php/php-8.3.6/Zend/zend_builtin_functions.c:1781
#4 0x0000592f9ed6357c in zend_default_exception_new (class_type=0x592fa0e8fb90) at /usr/src/debug/php/php-8.3.6/Zend/zend_exceptions.c:265
#5 0x0000592f9ece188c in _object_and_properties_init (properties=0x0, class_type=0x592fa0e8fb90, arg=0x7ffdf7951ca8) at /usr/src/debug/php/php-8.3.6/Zend/zend_API.c:1781
#6 object_init_ex (arg=0x7ffdf7951ca8, class_type=0x592fa0e8fb90) at /usr/src/debug/php/php-8.3.6/Zend/zend_API.c:1795
#7 0x0000592f9ea3ced0 in zend_throw_exception_zstr (exception_ce=exception_ce@entry=0x592fa0e8fb90, message=message@entry=0x701fcc66f100, code=code@entry=0)
at /usr/src/debug/php/php-8.3.6/Zend/zend_exceptions.c:828
#8 0x0000592f9ea3cfe6 in zend_throw_exception (exception_ce=0x592fa0e8fb90, message=<optimized out>, code=0) at /usr/src/debug/php/php-8.3.6/Zend/zend_exceptions.c:848
#9 0x0000592f9ea2cbed in zend_throw_error (exception_ce=0x592fa0e8fb90, format=<optimized out>) at /usr/src/debug/php/php-8.3.6/Zend/zend.c:1733
#10 0x0000592f9ea46e8c in zend_throw_or_error.constprop.0 (fetch_type=512, exception_ce=0x0, format=<optimized out>, exception_ce=0x0)
at /usr/src/debug/php/php-8.3.6/Zend/zend_execute_API.c:241
#11 0x0000592f9ea36116 in zend_fetch_class_by_name (fetch_type=512, key=<optimized out>, class_name=0x701fcc602210) at /usr/src/debug/php/php-8.3.6/Zend/zend_execute_API.c:1729
#12 ZEND_NEW_SPEC_CONST_UNUSED_HANDLER (execute_data=0x701fcc613020) at /usr/src/debug/php/php-8.3.6/Zend/zend_vm_execute.h:10519
#13 0x0000592f9ed55658 in execute_ex (ex=<optimized out>) at /usr/src/debug/php/php-8.3.6/Zend/zend_vm_execute.h:57007
#14 0x0000592f9eccb9ae in zend_call_function (fci=fci@entry=0x7ffdf7952040, fci_cache=<optimized out>, fci_cache@entry=0x0) at /usr/src/debug/php/php-8.3.6/Zend/zend_execute_API.c:957
#15 0x0000592f9eccbced in _call_user_function_impl (object=<optimized out>, function_name=<optimized out>, retval_ptr=<optimized out>, param_count=<optimized out>, params=<optimized out>,
named_params=<optimized out>) at /usr/src/debug/php/php-8.3.6/Zend/zend_execute_API.c:753
#16 0x0000592f9ea2ca1b in zend_user_exception_handler () at /usr/src/debug/php/php-8.3.6/Zend/zend.c:1847
#17 0x0000592f9ea2d12a in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/debug/php/php-8.3.6/Zend/zend.c:1895
#18 0x0000592f9ec69586 in php_execute_script (primary_file=<optimized out>) at /usr/src/debug/php/php-8.3.6/main/main.c:2507
#19 0x0000592f9edc9f19 in do_cli (argc=2, argv=0x592fa0d8ed20) at /usr/src/debug/php/php-8.3.6/sapi/cli/php_cli.c:966
#20 0x0000592f9ea48b10 in main (argc=2, argv=<optimized out>) at /usr/src/debug/php/php-8.3.6/sapi/cli/php_cli.c:1340
Since exception handler and autoloader are involved, I suspect that it might be the same/similar issue as https://bugs.php.net/bug.php?id=81580
PHP Version
PHP 8.3.6
Operating System
Archlinux
Reacted by Maarten S
Activity
iluuu1994 commentedon Apr 19, 2024
Thank for the report. I can verify this.
Details
iluuu1994 commentedon Apr 19, 2024
cleanup_unfinished_callsis missing handling forZEND_CALLABLE_CONVERT. I'll create a PR shortly.Fix missing handling of CALLABLE_CONVERT in cleanup_unfinished_calls()
Fix missing handling of CALLABLE_CONVERT in cleanup_unfinished_calls()