php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #69221 Segmentation fault when using a generator in combination with an Iterator
Submitted: 2015-03-11 15:17 UTC Modified: 2015-03-11 16:54 UTC
From: jose dot zap at gmail dot com Assigned: nikic
Status: Closed Package: SPL related
PHP Version: 5.6.6 OS: Linux
Private report: No CVE-ID:
 [2015-03-11 15:17 UTC] jose dot zap at gmail dot com
Description:
------------
When combining a generator with a custom IteratorIterator, after iterating the elements of the object I get a segmentation fault.

Test script:
---------------
<?php

$gen = function() {
	yield 1;
};

$iter = new IteratorIterator($gen());
$ngen = $iter->getInnerIterator();

class ReplaceIterator extends IteratorIterator
{
	private $cb;
	
	function __construct($iter, $cb) {
		parent::__construct($iter);
		$this->cb = $cb;
	}
	
	function current() {
		$cb = $this->cb;
		return $cb(parent::current());
	}
}

$filter = new ReplaceIterator($ngen, function($a){ return $a; });

iterator_to_array($filter, false);

Actual result:
--------------
#0  0x00000000006f0e29 in gc_zval_possible_root (zv=0x7ffff7fd9398) at /usr/src/php5.5/source/dotdeb-php5/Zend/zend_gc.c:143
#1  0x00000000006f2877 in zend_generator_iterator_dtor (iterator=<optimized out>) at /usr/src/php5.5/source/dotdeb-php5/Zend/zend_generators.c:610
#2  0x00000000006f9d60 in zend_objects_store_del_ref_by_handle_ex (handle=2, handlers=<optimized out>) at /usr/src/php5.5/source/dotdeb-php5/Zend/zend_objects_API.c:212
#3  0x00000000006f9da3 in zend_objects_store_del_ref (zobject=0x7ffff7fdc040) at /usr/src/php5.5/source/dotdeb-php5/Zend/zend_objects_API.c:178
#4  0x00000000006c1090 in _zval_dtor (zvalue=0x7ffff7fdc040) at /usr/src/php5.5/source/dotdeb-php5/Zend/zend_variables.h:35
#5  i_zval_ptr_dtor (zval_ptr=0x7ffff7fdc040) at /usr/src/php5.5/source/dotdeb-php5/Zend/zend_execute.h:81
#6  _zval_ptr_dtor (zval_ptr=<optimized out>) at /usr/src/php5.5/source/dotdeb-php5/Zend/zend_execute_API.c:423
#7  0x00000000006ddcc5 in zend_hash_apply_deleter (ht=ht@entry=0xea53a8, p=p@entry=0x7ffff7fd93c8) at /usr/src/php5.5/source/dotdeb-php5/Zend/zend_hash.c:650
#8  0x00000000006df801 in zend_hash_reverse_apply (ht=ht@entry=0xea53a8, apply_func=apply_func@entry=0x6c0f60 <zval_call_destructor>)
    at /usr/src/php5.5/source/dotdeb-php5/Zend/zend_hash.c:804
#9  0x00000000006c13a1 in shutdown_destructors () at /usr/src/php5.5/source/dotdeb-php5/Zend/zend_execute_API.c:214
#10 0x00000000006d1007 in zend_call_destructors () at /usr/src/php5.5/source/dotdeb-php5/Zend/zend.c:930
#11 0x000000000066f5b5 in php_request_shutdown (dummy=dummy@entry=0x0) at /usr/src/php5.5/source/dotdeb-php5/main/main.c:1750
#12 0x0000000000782d98 in do_cli (argc=2, argv=0xea6cf0) at /usr/src/php5.5/source/dotdeb-php5/sapi/cli/php_cli.c:1177
#13 0x000000000043239f in main (argc=2, argv=0xea6cf0) at /usr/src/php5.5/source/dotdeb-php5/sapi/cli/php_cli.c:1378

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-03-11 15:40 UTC] nikic@php.net
Simplified reproduce code:

<?php

$gen = function() {
    yield 1;
};

$iter = new IteratorIterator($gen());
$ngen = $iter->getInnerIterator();

iterator_to_array($ngen, false);
 [2015-03-11 16:54 UTC] laruence@php.net
-Assigned To: +Assigned To: nikic
 [2015-03-11 16:54 UTC] laruence@php.net
-Status: Assigned +Status: Open
 [2015-03-13 15:31 UTC] nikic@php.net
Automatic comment on behalf of nikic
Revision: http://git.php.net/?p=php-src.git;a=commit;h=a9d73f0646ca95134f5f2ada0899a7616c1ea705
Log: Fixed bug #69221
 [2015-03-13 15:31 UTC] nikic@php.net
-Status: Assigned +Status: Closed
 
PHP Copyright © 2001-2017 The PHP Group
All rights reserved.
Last updated: Mon Feb 27 04:01:38 2017 UTC