|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #77530 PHP crashes when parsing `(2)::class`
Submitted: 2019-01-27 21:49 UTC Modified: 2019-01-28 13:34 UTC
From: tysonandre775 at hotmail dot com Assigned: kalle (profile)
Status: Closed Package: *General Issues
PHP Version: 7.3.2RC1 OS:
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: tysonandre775 at hotmail dot com
New email:
PHP Version: OS:


 [2019-01-27 21:49 UTC] tysonandre775 at hotmail dot com
When an expression such as `(2)::class` (with brackets) is parsed in source code, PHP (debug and non-debug) crashes.

Debug builds emit this failure: "/path/to/php-src/Zend/zend_ast.h:298: zend_ast_get_str: Assertion `zval_get_type(&(*(zv))) == 6' failed."

This may also affect stable php versions. I also saw this in a recent PHP 7.4 build.

Non-debug builds segfault:

Program received signal SIGSEGV, Segmentation fault.
0x00000000009b5e19 in zend_get_class_fetch_type ()
(gdb) bt
#0  0x00000000009b5e19 in zend_get_class_fetch_type ()
#1  0x00000000009b62e0 in zend_try_compile_const_expr_resolve_class_name.part ()
#2  0x00000000009bcc5a in zend_compile_class_const ()
#3  0x00000000009bd255 in zend_compile_expr ()
#4  0x00000000009be6ab in zend_compile_echo ()
#5  0x00000000009c55e8 in zend_compile_stmt ()
#6  0x00000000009c972a in zend_compile_top_stmt ()
#7  0x00000000009c977f in zend_compile_top_stmt ()
#8  0x00000000009c977f in zend_compile_top_stmt ()
#9  0x000000000099c3dd in zend_compile ()
#10 0x000000000099dfb8 in compile_string ()
#11 0x00000000009cd00b in zend_eval_stringl ()
#12 0x00000000007e6967 in readline_shell_run ()
#13 0x0000000000a822c5 in do_cli ()
#14 0x000000000045f56c in main ()

Test script:
if (false) {
    echo (2)::class;

Expected result:
Should not segfault. Instead, it should emit a similar error to what PHP already does in other cases

php > echo []::class;
Fatal error: Dynamic class names are not allowed in compile-time ::class fetch in php shell code on line 1


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2019-01-28 07:17 UTC]
Nice one, how did you run across that?
(2)::class is pretty obscure.
 [2019-01-28 07:57 UTC] bugsnet at ekins dot space
Hi! I've submitted a PR for this bug:
 [2019-01-28 08:26 UTC]
Automatic comment on behalf of
Log: Fixed bug #77530: PHP crashes when parsing &quot;(2)::class&quot;
 [2019-01-28 08:26 UTC]
-Status: Open +Status: Closed
 [2019-01-28 13:34 UTC]
-Assigned To: +Assigned To: kalle
 [2019-01-28 13:34 UTC]
@rasmus: see comments on
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Mon May 10 22:01:24 2021 UTC