#22510 [Opn->Ver]: Zend Engine crashes calling FREE_ZVAL from zend_assign_to_variable_reference

[moriyoshi]

 ID:               22510
 Updated by:       [EMAIL PROTECTED]
 Reported By:      php at codewhore dot org
-Status:           Open
+Status:           Verified
 Bug Type:         Scripting Engine problem
 Operating System: Linux 2.4
-PHP Version:      4CVS-2003-03-02 (stable)
+PHP Version:      4CVS-2003-03-04 (stable)


Previous Comments:
------------------------------------------------------------------------

[2003-03-04 08:21:37] php at codewhore dot org

Here's another far more compact version:

<?php

  class module
  {
    var $list;

    function finalize()
    {
      $cl =& $this->list;
    }

    function method(&$controller)
    {
      $controller->get();
    }
  }

  class controller
  {
    function &get()
    {
      return @$this->foo;
    }

    function call()
    {
      call_user_func_array($this->sym, array(&$this));
    }

    function load()
    {
      $instance =& new module();
      $this->instance =& $instance;
      $this->sym = array(&$instance, 'method');
    }

    function run()
    {
      $this->load();
      $this->call();
      $this->call();
    }
  }

  class application
  {
    function run(&$controller)
    {
      $removing_this_global_usage_prevents_segv = @$_GET['x'];
      $controller->run();
    }
  }

  $controller = new controller();
  application::run($controller);
  $controller->instance->finalize();

?>

------------------------------------------------------------------------

[2003-03-03 15:35:00] php at codewhore dot org

Hi:

Thanks for waiting. Below is a test case which I've used to
reproducibly crash 4.3.0 and 4.3.2-dev on three seperate machines.
Sorry it's so long, but this is the absolute minimum I was able to come
up with. I haven't captured another backtrace for this particular case
yet, but I'd be happy to do so if you'd like.

---- >8 --- cut here --- 8< ----

<?php

  class module
  {
    function module(&$controller)
    {
      $this->controller =& $controller;
    }
  }

  class runnable_module extends module
  {
    function initialize() { }
    function finalize()   { }
    function method()     { }
  }


  class first extends runnable_module
  {
    function method()
    {
      $data =& $this->controller->get($data);
    }
  }


  class second extends runnable_module
  {
    function initialize()
    {
      $this->list = array();
    }

    function finalize()
    {
      echo "About to get SIGSEGV...\n";
      $cl =& $this->list;
      echo "Shouldn't see this\n";
    }
  }


  class controller
  {
    function finalize()
    {
      foreach ($this->module_list as $k => $x)
        $this->module_list[$k]->finalize();
    }

    function &get($name)
    {
      return @$this->vars[$name];
    }

    function call($function)
    {
      $symbol =& $this->symtab[$function][0];
      call_user_func($symbol, array());
    }

    function load($name, $method)
    {
      $instance =& new $name($this);
      $instance->initialize();
      $this->module_list[$name] =& $instance;
      $this->symtab[$name] = array(array(&$instance, $method));
    }

    function run()
    {
      $this->load('first', 'method');
      $this->load('second', 'method');
      $this->call('first');
      $this->call('first');
    }
  }


  class application
  {
    function application(&$controller)
    {
      $this->controller =& $controller;
    }

    function run()
    {
      $controller =& $this->controller;
      $removing_this_global_usage_prevents_segv = $_GET['x'];
      $controller->run();
    }
  }


  $controller = new controller();
  $app = new application($controller);
  $app->run();
  $controller->finalize();

?>

---- >8 --- cut here --- 8< ----

Thanks again,
- Dave

------------------------------------------------------------------------

[2003-03-03 11:36:18] [EMAIL PROTECTED]

keep at feedback status until the asked feedback is actually given..


------------------------------------------------------------------------

[2003-03-03 07:47:15] php at codewhore dot org

I'm working on it - there's a ton of code here, and it's proving
difficult to pare it down to a simple test case. However, I hope to
have one posted by the end of the day today.

Thanks.

------------------------------------------------------------------------

[2003-03-03 00:59:43] [EMAIL PROTECTED]

Please provide us a minimum and self-contained script for reproducing
the problem.

I cannot reproduce this with the following code;

<?php
class foo
{
  function transaction_commit() {
    return true;
  }
}
class test
{
  var $commit_list;
  function test() {
    $a = array('a'=>new foo(), 'b'=>new foo());
    $this->commit_list = &$a;
  }
  function finalize() {
    $cl =& $this->commit_list;

    foreach ($cl as $k => $x)
    {
      if (!$cl[$k]->transaction_commit())
        return $this->throw(E_SYS);
    }

    return true;
  }
}

$a = new test();
$a->finalize();
?>


------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
    http://bugs.php.net/22510

-- 
Edit this bug report at http://bugs.php.net/?id=22510&edit=1