php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #24708 Calling restore_error_handler() in a destructor crashes things
Submitted: 2003-07-18 14:26 UTC Modified: 2003-07-27 11:00 UTC
From: auroraeosrose at hotmail dot com Assigned:
Status: Closed Package: Scripting Engine problem
PHP Version: 5.0.0b2-dev OS: *
Private report: No CVE-ID: None
 [2003-07-18 14:26 UTC] auroraeosrose at hotmail dot com
Description:
------------
Latest php snap of 5.0
Apache 2 filter
mb_string, gd, mssql, and mysql only dll's loaded

Error handler class - constructor calls set_error_handler and works just fine, descructor calls restore_error_handler and the server crashes nicely - not only the phpdll but all of apache as well in a second message.  I have some dump files if you need them, just leave a message.

Reproduce code:
---------------
<?php
class Error
{
	function __construct()
	{
		set_error_handler(array(&$this, 'handler'));
	}

	function __destruct()
	{
		restore_error_handler();
	}

	function handler($no, $str, $file, $line, $ctx)
	{
		echo '<pre>';
		echo 'no   : ' . $no . "\n";
		echo 'str  : ' . $str . "\n";
		echo 'file : ' . $file . "\n";
		echo 'line : ' . $line . "\n";
		echo 'ctx  : ';
		print_r($ctx);
		echo '</pre>';
	}

}

$error = new error();
echo $dog;

?> 

Expected result:
----------------
no   : 8
str  : Undefined variable:  dog
file : ****/test.php
line : 29
ctx  : Array
(
    [GLOBALS] => Array
 *RECURSION*
    [_POST] => Array
        (
        )

    [_GET] => Array
        (
        )

    [_COOKIE] => Array
        (
        )

    [_FILES] => Array
        (
        )

    [error] => error Object
        (
        )

)

Actual result:
--------------
Comment out the restore_error_handler and it works jim dandy

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-07-18 14:54 UTC] auroraeosrose at hotmail dot com
Oh, btw, using $error = &new Error(); makes no difference, the script(and php, and apache) crash exactly the same way.  Other functions, echoes, etc. that I've tried work fine in the destructor.
 [2003-07-19 08:31 UTC] sniper@php.net
Backtrace (with CLI):

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (runnable)]
0x81d30d1 in zend_objects_destroy_object (object=0x402a3230, handle=1) at /usr/src/web/php/php5/Zend/zend_objects.c:44
44                      if (destructor->op_array.fn_flags & (ZEND_ACC_PRIVATE|ZEND_ACC_PROTECTED)) {
(gdb) bt
#0  0x81d30d1 in zend_objects_destroy_object (object=0x402a3230, handle=1)
    at /usr/src/web/php/php5/Zend/zend_objects.c:44
#1  0x81d5a6f in zend_objects_store_del_ref (zobject=0x4029d3ac) at /usr/src/web/php/php5/Zend/zend_objects_API.c:142
#2  0x81bf7e2 in _zval_dtor (zvalue=0x4029d3ac, 
    __zend_filename=0x822a640 "/usr/src/web/php/php5/Zend/zend_execute_API.c", __zend_lineno=344)
    at /usr/src/web/php/php5/Zend/zend_variables.c:61
#3  0x81b463d in _zval_ptr_dtor (zval_ptr=0x402a3784, 
    __zend_filename=0x822ae40 "/usr/src/web/php/php5/Zend/zend_variables.c", __zend_lineno=165)
    at /usr/src/web/php/php5/Zend/zend_execute_API.c:344
#4  0x81bfb24 in _zval_ptr_dtor_wrapper (zval_ptr=0x402a3784) at /usr/src/web/php/php5/Zend/zend_variables.c:165
#5  0x81c8a9c in zend_hash_destroy (ht=0x402a36c0) at /usr/src/web/php/php5/Zend/zend_hash.c:509
#6  0x81bf7a9 in _zval_dtor (zvalue=0x402a3640, 
    __zend_filename=0x822a640 "/usr/src/web/php/php5/Zend/zend_execute_API.c", __zend_lineno=266)
    at /usr/src/web/php/php5/Zend/zend_variables.c:52
#7  0x81b4346 in shutdown_executor () at /usr/src/web/php/php5/Zend/zend_execute_API.c:266
#8  0x81c14b8 in zend_deactivate () at /usr/src/web/php/php5/Zend/zend.c:795
#9  0x817b91b in php_request_shutdown (dummy=0x0) at /usr/src/web/php/php5/main/main.c:1174
#10 0x81eecff in main (argc=2, argv=0xbffff694) at /usr/src/web/php/php5/sapi/cli/php_cli.c:1018
#11 0x401b19cb in __libc_start_main (main=0x81eda64 <main>, argc=2, argv=0xbffff694, init=0x806aefc <_init>, 
    fini=0x81ef644 <_fini>, rtld_fini=0x4000aea0 <_dl_fini>, stack_end=0xbffff68c)
    at ../sysdeps/generic/libc-start.c:92

 [2003-07-27 11:00 UTC] stas@php.net
This bug has been fixed in CVS.

In case this was a PHP problem, snapshots of the sources are packaged
every three hours; this change will be in the next snapshot. You can
grab the snapshot at http://snaps.php.net/.
 
In case this was a documentation problem, the fix will show up soon at
http://www.php.net/manual/.

In case this was a PHP.net website problem, the change will show
up on the PHP.net site and on the mirror sites in short time.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Thu Aug 28 21:00:03 2025 UTC