Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves. 

A proper reproducing script starts with <?php and ends with ?>,
is max. 10-20 lines long and does not require any external 
resources such as databases, etc. If the script requires a 
database to demonstrate the issue, please make sure it creates 
all necessary tables, stored procedures etc.

Please avoid embedding huge scripts into the report.

Ok, this is quite an obscure bug to diagnose and isolate, and involves interaction between nested helper objects and nested generators.

I have managed to strip it down to an example script of about 70 lines (I can't get it any smaller than that though) - http://pastebin.com/NRSUNvF8

This script consistently causes segfault on both OSX (homebrew) and ubuntu (ondrej ppa) with PHP 7.1.2 and all extensions turned off (using php -n test.php).

The critical code is the block of yield statements between lines 12 and 16; it is specifically the use of the helper objects, notably via the wrapped __call() -> __invoke() and direct method calls, plus the use() clause on the generator to bring in template data, all in concert that cause the error. Removing any of these elements causes the error to either stop completely or only show intermittently. Both helpers are required to generate the fault, using only one generally results in the script completing.

It seems like a predetermined memory allocation is either overflowing or prematurely released for the references to the helper objects and data, but this is just speculation. Either way, it's a critical show-stopper for us as we use this pattern extensively, we've had to revert to 7.0 syntax and distribution for now - any help is very much appreciated!

yeah, I can confirm this is caused by https://github.com/php/php-src/commit/9a159f37

@dmitry, I think this line below is suspicious. :

+ if (EXPECTED(num_args <= EX(func)->op_array.last_var)) {

as I understand this line should be:

+ if (EXPECTED(num_args <= EX(func)->op_array.num_args)) {


can you verify this?

thanks