php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #74297 Corruption of interned string cache leads to random behaviour
Submitted: 2017-03-23 11:01 UTC Modified: 2017-09-30 09:22 UTC
Votes:3
Avg. Score:4.3 ± 0.9
Reproduced:2 of 2 (100.0%)
Same Version:2 (100.0%)
Same OS:1 (50.0%)
From: arjen at parse dot nl Assigned: kelunik (profile)
Status: Closed Package: opcache
PHP Version: 7.1.3 OS: Linux
Private report: No CVE-ID: None
 [2017-03-23 11:01 UTC] arjen at parse dot nl
Description:
------------
php-memcached 3.0.3
libmemcached 1.0.18
memcached 1.4.32
php 7.1.3

Both memcached and opcache needs to be loaded. opcache.enable_cli is not needed.

php -n -dextension=memcached.so -dzend_extension=opcache.so script.php


If the value ('test') set in memcached is changed, the script no longer fails.


($e == $a) === false, while ($a == $e) === true...

Test script:
---------------
<?php

class r
{
	public $d = ['test' => 'x'];

	public function m()
	{
		return [] + $this->d;
	}
}

(function()
{
	$m = new memcached;
	$m->addServer('127.0.0.1', 11211);
	$m->set('Something', 'test');

	$e = ['test' => 'x'];
	$a = (new r)->m();

	if (0 == ($e <=> $a))
		return 'success';

	var_dump([$e, $a]);
	var_dump([serialize($e), serialize($a)]);
	var_dump([
		'e === a' => $e === $a,
		'e == a' => $e == $a,
		'e <=> a' => $e <=> $a,
		'a <=> e' => $a <=> $e,
		'a === e' => $a === $e,
		'a == e' => $a == $e]
	);

	var_dump(debug_zval_dump($e), debug_zval_dump($a));

	die('this should not happen');
})();


Expected result:
----------------
success

Actual result:
--------------
array(2) {
  [0]=>
  array(1) {
    ["test"]=>
    string(1) "x"
  }
  [1]=>
  array(1) {
    ["test"]=>
    string(1) "x"
  }
}
array(2) {
  [0]=>
  string(25) "a:1:{s:4:"test";s:1:"x";}"
  [1]=>
  string(25) "a:1:{s:4:"test";s:1:"x";}"
}
array(6) {
  ["e === a"]=>
  bool(true)
  ["e == a"]=>
  bool(false)
  ["e <=> a"]=>
  int(1)
  ["a <=> e"]=>
  int(0)
  ["a === e"]=>
  bool(true)
  ["a == e"]=>
  bool(true)
}
array(1) refcount(1){
  ["test"]=>
  string(1) "x" refcount(1)
}
array(1) refcount(2){
  ["test"]=>
  string(1) "x" refcount(1)
}


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2017-03-23 11:03 UTC] arjen at parse dot nl
Test script sometimes does not fail on first run, so please try a few times..
 [2017-04-25 10:01 UTC] arjen at parse dot nl
-Summary: Simple comparison fails +Summary: Corruption of interned string cache leads to random behaviour
 [2017-04-25 10:01 UTC] arjen at parse dot nl
Also reported @ https://github.com/php-memcached-dev/php-memcached/issues/338
 [2017-04-25 10:02 UTC] arjen at parse dot nl
When the interned string cache buffer is configured to 0, everything works fine: php -n -dextension=memcached.so -dzend_extension=opcache.so -dopcache.interned_strings_buffer=0 test.php
 [2017-05-16 23:37 UTC] aaron at serendipity dot cx
As the maintainer of php-memcached extension:

I am not able to reproduce the problem with PHP 7.0.17 on Mac OS X.

I *can* reproduce the problem with PHP 7.1.3 on Mac OS X.

Who can help me understand what changedPHP 7.0 -> 7.1 that might be causing this problem?
 [2017-09-30 09:22 UTC] kelunik@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: kelunik
 
PHP Copyright © 2001-2022 The PHP Group
All rights reserved.
Last updated: Thu Sep 29 18:03:43 2022 UTC