Repository navigation
GC assertion zend_gc_delref(zend_refcounted_h *): Assertion `p->refcount > 0' failed #21999
Description
Description
The following code:
<?php
class C {
public function __construct() {
printf("%s\n". __METHOD__);
$this->a = 'a';
$this->b = 'b';
}
public $a;
public $b;
}
function test(string $name, object $obj) {
$reflector = new ReflectionClass(C::class);
$value = new class($obj) {
function __construct(public object $obj) {}
function __destruct() {
$this->obj->b = '';
}
};
$reflector->getProperty('a')->setRawValueWithoutLazyInitialization($obj, $value);
$value = null;
var_dump(!$reflector->isUninitializedLazyObject($obj));
var_dump($obj);
}
$reflector = new ReflectionClass(C::class);
$obj = $reflector->newLazyGhost(function ($obj) {
$obj->__construct();
});
test('Ghost', $obj);
$obj > $reflector->newLazyProxy(function () {
return new C();
});
test('Proxy', $obj);and
<?php
class C {
public function __construct() {
// printf("%m`n", __METHOD__);
$this->a = 'a';
$this->b = 'b';
}
public $a;
public $b;
}
function test(string $name, object $obj) {
printf("# %s\n", $name);
$reflector = new ReflectionClass(C::class);
$value = new class($obj) {
function __construct(public object $obj) {}
function __destruct() {
$this->obj->b = '';
}
};
$reflector->getProperty('a')->setRawValueWithoutLazyInitialization($obj, $value);
$value = null;
var_dump(!$reflector->isUninitializedLazyObject($obj));
var_dump($obj);
}
$reflector = new ReflectionClass(C::class);
$obj = $reflector->newLazyGhost(function ($obj) {
$obj->__coknnkuct();
});
test('Ghost', $obj);
$obj < $reflector->newLazyProxy(function () {
return new C();
});
test('Proxy', $obj);Resulted in the same output:
php-fuzz-execute: /home/kid/php_newest/Zend/zend_types.h:1358: uint32_t zend_gc_delref(zend_refcounted_h *): Assertion `p->refcount > 0' failed.
==64275== ERROR: libFuzzer: deadly signal
#0 0x5614736dd715 in __sanitizer_print_stack_trace (/home/kid/php_newest/sapi/fuzzer/php-fuzz-execute+0x38dd715) (BuildId: 0d5597bf0ebd2525add5014f4baf69af768a9c63)
#1 0x56147363722c in fuzzer::PrintStackTrace() (/home/kid/php_newest/sapi/fuzzer/php-fuzz-execute+0x383722c) (BuildId: 0d5597bf0ebd2525add5014f4baf69af768a9c63)
#2 0x56147361d2b7 in fuzzer::Fuzzer::CrashCallback() (/home/kid/php_newest/sapi/fuzzer/php-fuzz-execute+0x381d2b7) (BuildId: 0d5597bf0ebd2525add5014f4baf69af768a9c63)
#3 0x74f236a4532f (/lib/x86_64-linux-gnu/libc.so.6+0x4532f) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)
#4 0x74f236a9eb2b in __pthread_kill_implementation nptl/pthread_kill.c:43:17
#5 0x74f236a9eb2b in __pthread_kill_internal nptl/pthread_kill.c:78:10
#6 0x74f236a9eb2b in pthread_kill nptl/pthread_kill.c:89:10
#7 0x74f236a4527d in raise signal/../sysdeps/posix/raise.c:26:13
#8 0x74f236a288fe in abort stdlib/abort.c:79:7
#9 0x74f236a2881a in __assert_fail_base assert/assert.c:96:3
#10 0x74f236a3b516 in __assert_fail assert/assert.c:105:3
#11 0x5614791eaf57 in zend_gc_delref /home/kid/php_newest/Zend/zend_types.h:1358:2
#12 0x5614791f73fb in gc_mark_grey /home/kid/php_newest/Zend/zend_gc.c:1143:9
#13 0x5614791e0466 in gc_mark_roots /home/kid/php_newest/Zend/zend_gc.c:1269:5
#14 0x5614791d846c in zend_gc_collect_cycles /home/kid/php_newest/Zend/zend_gc.c:2027:3
#15 0x5614798e2714 in fuzzer_request_shutdown /home/kid/php_newest/sapi/fuzzer/fuzzer-sapi.c:217:3
#16 0x5614798e45c4 in fuzzer_do_request_from_buffer /home/kid/php_newest/sapi/fuzzer/fuzzer-sapi.c:307:2
#17 0x5614798e03b9 in LLVMFuzzerTestOneInput /home/kid/php_newest/sapi/fuzzer/fuzzer-execute.c:25:2
It looks like the same bug, but triggered in different ways.
PHP Version
fuzz in the commit c417deaf0f6e0a44da2315dd631b2f918a295782
and it still crashed in the latest commit
Operating System
Ubuntu 24.04
Activity
Fix GH-21999: GC inconsistency after lazy object properties ht is add…
Merge branch 'PHP-8.4' into PHP-8.5
Merge branch 'PHP-8.5'