php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #78647 SEGFAULT in zend_do_perform_implementation_check
Submitted: 2019-10-08 12:31 UTC Modified: 2019-10-08 13:24 UTC
Votes:2
Avg. Score:4.0 ± 1.0
Reproduced:2 of 2 (100.0%)
Same Version:1 (50.0%)
Same OS:0 (0.0%)
From: leigh@php.net Assigned: nikic (profile)
Status: Closed Package: Reproducible crash
PHP Version: master-Git-2019-10-08 (Git) OS: Linux
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: leigh@php.net
New email:
PHP Version: OS:

 

 [2019-10-08 12:31 UTC] leigh@php.net 
Description:
------------
Present in PHP-7.4 / master branches but not PHP-7.3 branch. Compiled with `--disable-all`. Found using AFL.

Debug build hits the assertion in report_variance_errors with: Assertion `obligation->type == OBLIGATION_COMPATIBILITY' failed.  

Test script:
---------------
<?php

spl_autoload_register(function ($class) {
    if ($class == 'A') {
        class A
        {
            function m(): B {}
        }
    } elseif ($class == 'B') {
        class B extends A
        {
            function m(): X {}
        }
    } else {
        class C extends B {}
    }
});

new B;

Expected result:
----------------
Exit code 0

Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
zend_do_perform_implementation_check (unresolved_class=unresolved_class@entry=0x7fffffff9ad0, fe=0x0, proto=0x7ffff7a033b0) at /home/leigh/php-src/Zend/zend_inheritance.c:418
418             ZEND_ASSERT(!((fe->common.fn_flags & ZEND_ACC_CTOR)
(gdb) bt
#0  zend_do_perform_implementation_check (unresolved_class=unresolved_class@entry=0x7fffffff9ad0, fe=0x0, proto=0x7ffff7a033b0) at /home/leigh/php-src/Zend/zend_inheritance.c:418
#1  0x000055555597af9e in report_variance_errors (ce=0x7ffff7a03660) at /home/leigh/php-src/Zend/zend_inheritance.c:2268
#2  zend_do_link_class (ce=ce@entry=0x7ffff7a03660, lc_parent_name=lc_parent_name@entry=0x55555617dfb0) at /home/leigh/php-src/Zend/zend_inheritance.c:2369
#3  0x0000555555923ef2 in do_bind_class (lcname=0x7ffff7a6d1e0, lc_parent_name=0x55555617dfb0) at /home/leigh/php-src/Zend/zend_compile.c:1076
#4  0x000055555598d155 in ZEND_DECLARE_CLASS_SPEC_CONST_HANDLER () at /home/leigh/php-src/Zend/zend_vm_execute.h:4342
#5  0x00005555559be1e3 in execute_ex (ex=0x7fffffff9ad0) at /home/leigh/php-src/Zend/zend_vm_execute.h:54252
#6  0x00005555559361f9 in zend_call_function (fci=fci@entry=0x7fffffff9d30, fci_cache=0x7ffff7a6d120, fci_cache@entry=0x7fffffff9d10) at /home/leigh/php-src/Zend/zend_execute_API.c:784
#7  0x00005555558426bc in zif_spl_autoload_call (execute_data=<optimised out>, return_value=<optimised out>) at /home/leigh/php-src/ext/spl/php_spl.c:450
#8  0x0000555555935ff7 in zend_call_function (fci=0x7fffffff9eb0, fci_cache=0x7fffffff9e90) at /home/leigh/php-src/Zend/zend_execute_API.c:799
#9  0x00005555559366f3 in zend_lookup_class_ex (name=<optimised out>, key=key@entry=0x0, flags=flags@entry=0) at /home/leigh/php-src/Zend/zend_execute_API.c:935
#10 0x00005555559368d9 in zend_lookup_class (name=<optimised out>) at /home/leigh/php-src/Zend/zend_execute_API.c:956
#11 0x000055555597aed7 in load_delayed_classes () at /home/leigh/php-src/Zend/zend_inheritance.c:2228
#12 zend_do_link_class (ce=ce@entry=0x7ffff7a033b0, lc_parent_name=lc_parent_name@entry=0x55555617df80) at /home/leigh/php-src/Zend/zend_inheritance.c:2365
#13 0x0000555555923ef2 in do_bind_class (lcname=0x7ffff7a6d1b0, lc_parent_name=0x55555617df80) at /home/leigh/php-src/Zend/zend_compile.c:1076
#14 0x000055555598d155 in ZEND_DECLARE_CLASS_SPEC_CONST_HANDLER () at /home/leigh/php-src/Zend/zend_vm_execute.h:4342
#15 0x00005555559be1e3 in execute_ex (ex=0x7fffffff9ad0) at /home/leigh/php-src/Zend/zend_vm_execute.h:54252
#16 0x00005555559361f9 in zend_call_function (fci=fci@entry=0x7fffffffa210, fci_cache=0x7ffff7a6d0e0, fci_cache@entry=0x7fffffffa1f0) at /home/leigh/php-src/Zend/zend_execute_API.c:784
#17 0x00005555558426bc in zif_spl_autoload_call (execute_data=<optimised out>, return_value=<optimised out>) at /home/leigh/php-src/ext/spl/php_spl.c:450
#18 0x0000555555935ff7 in zend_call_function (fci=0x7fffffffa390, fci_cache=0x7fffffffa370) at /home/leigh/php-src/Zend/zend_execute_API.c:799
#19 0x00005555559366f3 in zend_lookup_class_ex (name=name@entry=0x55555617d9b0, key=0x55555617dfb0, flags=flags@entry=512) at /home/leigh/php-src/Zend/zend_execute_API.c:935
#20 0x0000555555936f7c in zend_fetch_class_by_name (class_name=0x55555617d9b0, key=<optimised out>, fetch_type=fetch_type@entry=512) at /home/leigh/php-src/Zend/zend_execute_API.c:1365
#21 0x00005555559a4d77 in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at /home/leigh/php-src/Zend/zend_vm_execute.h:9116
#22 0x00005555559be07b in execute_ex (ex=0x7fffffff9ad0) at /home/leigh/php-src/Zend/zend_vm_execute.h:54692
#23 0x00005555559c4f4d in zend_execute (op_array=0x7ffff7a802a0, return_value=<optimised out>) at /home/leigh/php-src/Zend/zend_vm_execute.h:58019
#24 0x00005555559437b1 in zend_execute_scripts (type=type@entry=8, retval=0x7ffff7a82200, retval@entry=0x0, file_count=file_count@entry=3) at /home/leigh/php-src/Zend/zend.c:1643
#25 0x00005555558e5780 in php_execute_script (primary_file=<optimised out>) at /home/leigh/php-src/main/main.c:2585
#26 0x00005555559c6f6c in do_cli (argc=2, argv=0x555556172860) at /home/leigh/php-src/sapi/cli/php_cli.c:959
#27 0x000055555577e78d in main (argc=2, argv=0x555556172860) at /home/leigh/php-src/sapi/cli/php_cli.c:1350

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2019-10-08 13:24 UTC] nikic@php.net
-Assigned To: +Assigned To: nikic
 [2019-10-08 13:24 UTC] nikic@php.net 
This particular test script should generate a compile error because class X cannot be loaded but is needed for variance verification.

Here is a variant that fails with the same assertion but should compile file:

<?php

spl_autoload_register(function ($class) {
    if ($class == 'A') {
        class A
        {
            function m(): B {}
            function m2(): B {}
        }
    } elseif ($class == 'B') {
        class B extends A
        {
            function m(): X {}
            function m2(): Y {}
        }
    } elseif ($class == 'X') {
        class X extends B {} 
    } else { 
        class Y extends B {}
    } 
});

new B;
 [2021-11-08 09:00 UTC] git@php.net 
Automatic comment on behalf of nikic
Revision: https://github.com/php/php-src/commit/a38f4f9881789a45a1466939b3b76143d00af849
Log: Fix bug #78647
 [2021-11-08 09:00 UTC] git@php.net
-Status: Assigned +Status: Closed
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Nov 21 12:01:29 2024 UTC