php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #35277 incorrect recursion detection
Submitted: 2005-11-18 15:39 UTC Modified: 2010-11-07 21:05 UTC
Votes:3
Avg. Score:4.7 ± 0.5
Reproduced:2 of 2 (100.0%)
Same Version:1 (50.0%)
Same OS:1 (50.0%)
From: lsmith@php.net Assigned: dmitry (profile)
Status: Closed Package: Arrays related
PHP Version: 6CVS, 5CVS OS: *
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: lsmith@php.net
New email:
PHP Version: OS:

 

 [2005-11-18 15:39 UTC] lsmith@php.net
Description:
------------
PHP 5.1.0 seems to be overly paranoid when trying to detect a recursion. I do not know the internals but I do not think this is a duplicate of http://bugs.php.net/bug.php?id=29389.

Reproduce code:
---------------
$a = array(); $a[] = $a; var_dump($a);

Expected result:
----------------
array(1) { [0]=>  array(0) { } }

Actual result:
--------------
array(1) { [0]=>  array(1) { [0]=>  *RECURSION* } }

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-11-18 16:16 UTC] dmitry@php.net
The reason of this bug is IS_CV variables.
PHP doesn't increment/decrement refcount during fetching, also the order of fetches may be changed. In 5.1 and lvalue of "$a[] = $a" is evaluated before rvalue and changes rvalue (addes new element to array). Then $a is assigned into this element. As a result we got circular data structure where we shouldn't.

The same bug occurs with list()

Reproduce code:
---------------
<?php
$b = array("1","2","3");
list($a, $b, $c) = $b;
var_dump($a); //should print "1" (not "2")
var_dump($b);
var_dump($c);
$b = array("1","2","3");
list($a, $b[0], $c) = $b;
var_dump($a); //should print "1" (not "2")
var_dump($b);
var_dump($c);
?>

Expected result:
----------------
string(1) "1"
string(1) "2"
string(1) "3"
string(1) "1"
array(3) {
  [0]=>
  string(1) "2"
  [1]=>
  string(1) "2"
  [2]=>
  string(1) "3"
}
string(1) "3"

Actual result:
--------------
string(1) "2"
string(1) "2"
string(1) "3"
string(1) "2"
array(3) {
  [0]=>
  string(1) "2"
  [1]=>
  string(1) "2"
  [2]=>
  string(1) "3"
}
string(1) "3"

 [2007-03-05 18:24 UTC] sveta at microbecal dot com
Seems this bug affects comparision of objects which contains references to themself:

$cat >comparision.php
<?php

class A{
	private $a;
	
	public function __construct()
	{
		$this->a = $this;
	}
}

$a = array(new A, 1);
$b = array(new A, 1);

var_dump($a == $b);

?>
^C

$php comparision.php 

Fatal error: Nesting level too deep - recursive dependency? in /users/ssmirnova/comparision.php on line 15
 [2010-11-07 21:05 UTC] felipe@php.net
-Status: Suspended +Status: Closed
 [2010-11-07 21:05 UTC] felipe@php.net
Nowadays we got the expected result.

array(1) {
  [0]=>
  array(0) {
  }
}
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Tue Jul 01 02:01:36 2025 UTC