|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #48408 Exception thrown from two functions nested in expression causes segfault
Submitted: 2009-05-27 16:30 UTC Modified: 2009-05-27 19:23 UTC
From: nightstorm at tlen dot pl Assigned:
Status: Not a bug Package: Reproducible crash
PHP Version: 5.3CVS-2009-05-27 (snap) OS: Arch Linux 64-bit
Private report: No CVE-ID:
 [2009-05-27 16:30 UTC] nightstorm at tlen dot pl
The code provided below causes segfault on today's PHP 5.3 snapshot. The same script works correctly on PHP 5.2.9. I noticed that if you comment or change the line with "#1#" comment, the segmentation fault does not occur.

Reproduce code:
class B{
	public function process($x){
		return $x;
class C{
	public function generate($x){
		throw new Exception;
$b = new B;
$c = new C;
catch(Exception $e){
	$c->generate(0);// #1#

Expected result:
The script completes its work.

Actual result:
Segmentation fault:

Program terminated with signal 11, Segmentation fault.
[New process 17244]
#0  ZEND_HANDLE_EXCEPTION_SPEC_HANDLER (execute_data=0x7f0dbdf18050) at /usr/src/php-5.3-dev/Zend/zend.h:392
392             return --pz->refcount__gc;
(gdb) backtrace 5
#0  ZEND_HANDLE_EXCEPTION_SPEC_HANDLER (execute_data=0x7f0dbdf18050) at /usr/src/php-5.3-dev/Zend/zend.h:392
#1  0x0000000000741819 in execute (op_array=0x7f0dc11eacd0) at /usr/src/php-5.3-dev/Zend/zend_vm_execute.h:104
#2  0x0000000000717bf5 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/php-5.3-dev/Zend/zend.c:1188
#3  0x00000000006c5099 in php_execute_script (primary_file=0x7fffc936f510) at /usr/src/php-5.3-dev/main/main.c:2182
#4  0x00000000007a000e in main (argc=2, argv=0x7fffc936f778) at /usr/src/php-5.3-dev/sapi/cli/php_cli.c:1188


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2009-05-27 16:37 UTC] nightstorm at tlen dot pl
My PHP configuration:
 - The script was run in the CLI environment.
 - No extra patches or modifications were used.
 - PHP was compiled **without** debugging symbols (--enable-debug seems to "fix" the problem).
 - It was tested on today's snapshot of PHP 5.3.
 [2009-05-27 16:42 UTC]
Looks like same as (probable compiler bug).
 [2009-05-27 18:46 UTC]
Does not crash for me when PHP is compiled using GCC 4.1.2.
What GCC version are you using?
 [2009-05-27 19:05 UTC]
gcc 4.3 (does not crash here when recompiling zend_execute.c with gcc 4.1)
 [2009-05-27 19:23 UTC]
GCC bugs are not PHP bugs. And since this is already reported as well -> 
PHP Copyright © 2001-2015 The PHP Group
All rights reserved.
Last updated: Tue Dec 01 09:01:42 2015 UTC