php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #81558 Extension with observer segfaults when attribute is instantiated
Submitted: 2021-10-27 11:42 UTC Modified: 2021-10-27 15:34 UTC
From: beberlei@php.net Assigned: bwoebi (profile)
Status: Duplicate Package: *General Issues
PHP Version: 8.0.12 OS: Linux
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: beberlei@php.net
New email:
PHP Version: OS:

 

 [2021-10-27 11:42 UTC] beberlei@php.net
Description:
------------
An extension registering an observer will lead to a segfault in zend_observer_fcall_end for ReflectionAttribute::newInstance.

Stacktrace is:

Program received signal SIGSEGV, Segmentation fault.
0x0000555555d9dc07 in zend_observer_fcall_end (execute_data=0x7ffff46151a0, return_value=0x7fffffff8c80) at /home/benny/code/projects/php/php-src/Zend/zend_observer.c:232
232			          || !ZEND_OBSERVER_DATA(&ex->func->op_array)
(gdb) bt
#0  0x0000555555d9dc07 in zend_observer_fcall_end (execute_data=0x7ffff46151a0, return_value=0x7fffffff8c80) at /home/benny/code/projects/php/php-src/Zend/zend_observer.c:232
#1  0x0000555555d59c15 in execute_ex (ex=0x7ffff46151a0) at /home/benny/code/projects/php/php-src/Zend/zend_vm_execute.h:54537
#2  0x0000555555c9740c in zend_call_function (fci=0x7fffffff8cb0, fci_cache=0x7fffffff8c90) at /home/benny/code/projects/php/php-src/Zend/zend_execute_API.c:895
#3  0x0000555555c977ba in zend_call_known_function (fn=0x7ffff46041e8, object=0x7ffff46ce600, called_scope=0x7ffff4604018, retval_ptr=0x0, param_count=0, params=0x7ffff46662d0, 
    named_params=0x7ffff46ce360) at /home/benny/code/projects/php/php-src/Zend/zend_execute_API.c:985
#4  0x0000555555a3d965 in call_attribute_constructor (attr=0x7ffff469a7e0, ce=0x7ffff4604018, obj=0x7ffff46ce600, args=0x7ffff46662d0, argc=0, named_params=0x7ffff46ce360, filename=0x7ffff4603640)
    at /home/benny/code/projects/php/php-src/ext/reflection/php_reflection.c:6326
#5  0x0000555555a3e11e in zim_ReflectionAttribute_newInstance (execute_data=0x7ffff4615150, return_value=0x7ffff4615100) at /home/benny/code/projects/php/php-src/ext/reflection/php_reflection.c:6454
#6  0x0000555555ce2625 in execute_internal (execute_data=0x7ffff4615150, return_value=0x7ffff4615100) at /home/benny/code/projects/php/php-src/Zend/zend_execute.c:3414
#7  0x00007ffff4977a88 in tideways_execute_internal () from /home/benny/tideways/workspace/github.com/tideways/php-extension-next/modules/tideways.so
#8  0x0000555555ce9e33 in ZEND_DO_FCALL_SPEC_OBSERVER_HANDLER () at /home/benny/code/projects/php/php-src/Zend/zend_vm_execute.h:1973
#9  0x0000555555d59325 in execute_ex (ex=0x7ffff4615020) at /home/benny/code/projects/php/php-src/Zend/zend_vm_execute.h:54213
#10 0x0000555555d5ea5e in zend_execute (op_array=0x7ffff4660280, return_value=0x0) at /home/benny/code/projects/php/php-src/Zend/zend_vm_execute.h:58524
#11 0x0000555555caf3c5 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/benny/code/projects/php/php-src/Zend/zend.c:1680
#12 0x0000555555c10d34 in php_execute_script (primary_file=0x7fffffffb840) at /home/benny/code/projects/php/php-src/main/main.c:2539
#13 0x0000555555d9fb49 in do_cli (argc=96, argv=0x555556dc11c0) at /home/benny/code/projects/php/php-src/sapi/cli/php_cli.c:949
#14 0x0000555555da0b96 in main (argc=96, argv=0x555556dc11c0) at /home/benny/code/projects/php/php-src/sapi/cli/php_cli.c:1337

Could not reproduce this on the script with "zend_test", but it does for our own observer. Will put more work into getting a reproduce on zend_test.

More stacktraces from a larger app crashing: https://gist.github.com/beberlei/5bde1ea06f7dd4bfb42cf158c5779405

Test script:
---------------
<?php

#[Attribute]
class Entity
{
    public function __construct(
        private $table,
    ) {}
}

#[Entity(table: "product")]
class Product
{
}

$reflectionClass = new \ReflectionClass('Product');
$entity = $reflectionClass->getAttributes()[0]->newInstance();



Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2021-10-27 11:42 UTC] beberlei@php.net
-Assigned To: +Assigned To: bwoebi
 [2021-10-27 15:34 UTC] bwoebi@php.net
-Status: Assigned +Status: Duplicate
 [2021-10-27 15:34 UTC] bwoebi@php.net
Duplicate of #81430
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Wed Jul 02 11:01:36 2025 UTC