php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #71133 segfault on exception from generator
Submitted: 2015-12-16 07:49 UTC Modified: 2017-01-02 14:23 UTC
From: Bernhard dot Liebl at rz dot uni-regensburg dot de Assigned: laruence (profile)
Status: Closed Package: Scripting Engine problem
PHP Version: 5.6.16 OS: Linux
Private report: No CVE-ID: None
View Developer Edit
 [2015-12-16 07:49 UTC] Bernhard dot Liebl at rz dot uni-regensburg dot de 
Description:
------------
Throwing an exception from a generator under certain conditions produces a segfault. Happens with php 5.5.9 and php 5.6.16. Seems to be fixed with php 7.

Test script:
---------------
<?php

$a = function() {
    try {
        yield 1;
    } finally {
        throw new Exception();
    }
};

$b = function() {
    yield 1;
};

echo "starting " . phpversion() . "\n";
try {
    foreach ($a() as $x) {
        foreach ($b() as $y) {
            return true;
        }
    }
} catch (Exception $e) {
    echo "caught exception.\n";
}
echo "exit.\n";

Expected result:
----------------
starting 7.0.0
caught exception.
exit.

Actual result:
--------------
OUTPUT:
starting 5.6.16

COREDUMPS THEN
BACKTRACE:

Program received signal SIGSEGV, Segmentation fault.
0x000000000070d359 in gc_zval_possible_root ()
(gdb) bt
#0  0x000000000070d359 in gc_zval_possible_root ()
#1  0x000000000079b287 in ?? ()
#2  0x0000000000717e28 in execute_ex ()
#3  0x00000000006ddf89 in dtrace_execute_ex ()
#4  0x00000000006efa10 in zend_execute_scripts ()
#5  0x000000000068f845 in php_execute_script ()
#6  0x00000000007a00ce in ?? ()
#7  0x0000000000461d90 in main ()

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-12-16 08:21 UTC] laruence@php.net 
could you try to test agian by "php -n" , which will disable all other third-part extensions.
 [2015-12-16 09:08 UTC] Bernhard dot Liebl at rz dot uni-regensburg dot de 
Test on my local installation:

$ php -n coredump.php
starting 5.5.9-1ubuntu4.14
Segmentation fault (core dumped)

Also happens with php -n on clean docker images php:5.5-cli (5.5.30) and php:5.6-cli (5.6.16).
 [2015-12-16 10:38 UTC] nikic@php.net
-Package: PHP Language Specification +Package: Scripting Engine problem
 [2015-12-16 15:08 UTC] laruence@php.net 
I can not reproduce this on Ubuntu (valgrind also clean)
 [2015-12-16 21:49 UTC] stas@php.net 
Reproduces for me on 5.6:

0x00000001006935c8 in gc_zval_possible_root (zv=0x102e9f8e8) at /Users/smalyshev/php-5.6/Zend/zend_gc.c:143
143			GC_ZOBJ_CHECK_POSSIBLE_ROOT(zv);
(gdb) bt
#0  0x00000001006935c8 in gc_zval_possible_root (zv=0x102e9f8e8) at /Users/smalyshev/php-5.6/Zend/zend_gc.c:143
#1  0x000000010074ff65 in gc_zval_check_possible_root (z=0x102e9f8e8) at /Users/smalyshev/php-5.6/Zend/zend_gc.h:183
#2  i_zval_ptr_dtor (zval_ptr=<optimized out>, zval_ptr=<optimized out>) at /Users/smalyshev/php-5.6/Zend/zend_execute.h:86
#3  ZEND_HANDLE_EXCEPTION_SPEC_HANDLER (execute_data=0x102e69370) at /Users/smalyshev/php-5.6/Zend/zend_vm_execute.h:1240
#4  0x00000001006addb1 in execute_ex (execute_data=0x102e69370) at /Users/smalyshev/php-5.6/Zend/zend_vm_execute.h:363
#5  0x00000001006ae8a8 in zend_execute (op_array=0x102e9e490) at /Users/smalyshev/php-5.6/Zend/zend_vm_execute.h:388
#6  0x0000000100662064 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /Users/smalyshev/php-5.6/Zend/zend.c:1341
#7  0x00000001005b5849 in php_execute_script (primary_file=0x7fff5fbfee10) at /Users/smalyshev/php-5.6/main/main.c:2597
#8  0x00000001007b4a03 in do_cli (argc=2, argv=0x103800cb0) at /Users/smalyshev/php-5.6/sapi/cli/php_cli.c:994
#9  0x00000001007b3773 in main (argc=2, argv=0x103800cb0) at /Users/smalyshev/php-5.6/sapi/cli/php_cli.c:1378
 [2015-12-16 21:49 UTC] stas@php.net
-Status: Open +Status: Verified
 [2015-12-18 07:40 UTC] laruence@php.net
-Assigned To: +Assigned To: laruence
 [2015-12-18 07:40 UTC] laruence@php.net 
I can reproduce this now.

however this is somehow a knew issue.... :<
 [2017-01-02 14:23 UTC] nikic@php.net
-Status: Verified +Status: Closed
 [2017-01-02 14:23 UTC] nikic@php.net 
Closing as this has been fixed in PHP 7.0 and PHP 5.6 is going out of active support.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Wed Oct 29 01:00:01 2025 UTC