php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #48408 Exception thrown from two functions nested in expression causes segfault
Submitted: 2009-05-27 16:30 UTC Modified: 2009-05-27 19:23 UTC
From: nightstorm at tlen dot pl Assigned:
Status: Not a bug Package: Reproducible crash
PHP Version: 5.3CVS-2009-05-27 (snap) OS: Arch Linux 64-bit
Private report: No CVE-ID:
 [2009-05-27 16:30 UTC] nightstorm at tlen dot pl
Description:
------------
The code provided below causes segfault on today's PHP 5.3 snapshot. The same script works correctly on PHP 5.2.9. I noticed that if you comment or change the line with "#1#" comment, the segmentation fault does not occur.

Reproduce code:
---------------
<?php
class B{
	public function process($x){
		return $x;
	}
}
class C{
	public function generate($x){
		throw new Exception;
	}
}
$b = new B;
$c = new C;
try{
	$b->process($c->generate(0));
}
catch(Exception $e){
	$c->generate(0);// #1#
}

Expected result:
----------------
The script completes its work.

Actual result:
--------------
Segmentation fault:

Program terminated with signal 11, Segmentation fault.
[New process 17244]
#0  ZEND_HANDLE_EXCEPTION_SPEC_HANDLER (execute_data=0x7f0dbdf18050) at /usr/src/php-5.3-dev/Zend/zend.h:392
392             return --pz->refcount__gc;
(gdb) backtrace 5
#0  ZEND_HANDLE_EXCEPTION_SPEC_HANDLER (execute_data=0x7f0dbdf18050) at /usr/src/php-5.3-dev/Zend/zend.h:392
#1  0x0000000000741819 in execute (op_array=0x7f0dc11eacd0) at /usr/src/php-5.3-dev/Zend/zend_vm_execute.h:104
#2  0x0000000000717bf5 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/php-5.3-dev/Zend/zend.c:1188
#3  0x00000000006c5099 in php_execute_script (primary_file=0x7fffc936f510) at /usr/src/php-5.3-dev/main/main.c:2182
#4  0x00000000007a000e in main (argc=2, argv=0x7fffc936f778) at /usr/src/php-5.3-dev/sapi/cli/php_cli.c:1188

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2009-05-27 16:37 UTC] nightstorm at tlen dot pl
My PHP configuration:
 - The script was run in the CLI environment.
 - No extra patches or modifications were used.
 - PHP was compiled **without** debugging symbols (--enable-debug seems to "fix" the problem).
 - It was tested on today's snapshot of PHP 5.3.
 [2009-05-27 16:42 UTC] lbarnaud@php.net
Looks like same as http://bugs.php.net/bug.php?id=48228 (probable compiler bug).
 [2009-05-27 18:46 UTC] jani@php.net
Does not crash for me when PHP is compiled using GCC 4.1.2.
What GCC version are you using?
 [2009-05-27 19:05 UTC] lbarnaud@php.net
gcc 4.3 (does not crash here when recompiling zend_execute.c with gcc 4.1)
 [2009-05-27 19:23 UTC] jani@php.net
GCC bugs are not PHP bugs. And since this is already reported as well -> 
bogus.
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Sun Apr 20 20:02:01 2014 UTC