Repository navigation
Segfault with array_multisort + array_shift (packed arrays?) #9244
Description
Description
The following code:
<?php
$items = ['foo' => 1, 'bar' => 2];
$order = [4, 3];
array_multisort($order, $items);
var_dump(array_shift($items));Resulted in this output:
Segmentation fault (core dumped)
But I expected this output instead:
int(2)
After bisecting the relevant commit seems to be
commit 90b7bde61507cee1c6b37f153909d72f5b203b8c
Author: Dmitry Stogov <[email protected]>
Date: Wed Nov 3 15:18:26 2021 +0300
Use more compact representation for packed arrays.
- for packed arrays we store just an array of zvals without keys.
- the elements of packed array are accessible throuf as ht->arPacked[i]
instead of ht->arData[i]
- in addition to general ZEND_HASH_FOREACH_* macros, we introduced similar
familied for packed (ZEND_HASH_PACKED_FORECH_*) and real hashes
(ZEND_HASH_MAP_FOREACH_*)
- introduced an additional family of macros to access elements of array
(packed or real hashes) ZEND_ARRAY_ELEMET_SIZE, ZEND_ARRAY_ELEMET_EX,
ZEND_ARRAY_ELEMET, ZEND_ARRAY_NEXT_ELEMENT, ZEND_ARRAY_PREV_ELEMENT
- zend_hash_minmax() prototype was changed to compare only values
Because of smaller data set, this patch may show performance improvement
on some apps and benchmarks that use packed arrays. (~1% on PHP-Parser)
TODO:
- sapi/phpdbg needs special support for packed arrays (WATCH_ON_BUCKET).
- zend_hash_sort_ex() may require converting packed arrays to hash.
This commit is too complex for me to come up with a fix. But the last TODO mentioned in the commit message could be an indication of what is going wrong.
PHP Version
PHP 8.2.0-dev
Operating System
openSUSE Leap 15.3
Activity
Fix phpGH-9244: Segfault with array_multisort + array_shift