php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #78647 SEGFAULT in zend_do_perform_implementation_check
Submitted: 2019-10-08 12:31 UTC Modified: 2019-10-08 13:24 UTC
Votes:1
Avg. Score:3.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:0 (0.0%)
From: leigh@php.net Assigned: nikic (profile)
Status: Assigned Package: Reproducible crash
PHP Version: master-Git-2019-10-08 (Git) OS: Linux
Private report: No CVE-ID: None
View Add Comment Developer Edit
Have you experienced this issue?
Rate the importance of this bug to you:

 [2019-10-08 12:31 UTC] leigh@php.net 
Description:
------------
Present in PHP-7.4 / master branches but not PHP-7.3 branch. Compiled with `--disable-all`. Found using AFL.

Debug build hits the assertion in report_variance_errors with: Assertion `obligation->type == OBLIGATION_COMPATIBILITY' failed.  

Test script:
---------------
<?php

spl_autoload_register(function ($class) {
    if ($class == 'A') {
        class A
        {
            function m(): B {}
        }
    } elseif ($class == 'B') {
        class B extends A
        {
            function m(): X {}
        }
    } else {
        class C extends B {}
    }
});

new B;

Expected result:
----------------
Exit code 0

Actual result:
--------------
Program received signal SIGSEGV, Segmentation fault.
zend_do_perform_implementation_check (unresolved_class=unresolved_class@entry=0x7fffffff9ad0, fe=0x0, proto=0x7ffff7a033b0) at /home/leigh/php-src/Zend/zend_inheritance.c:418
418             ZEND_ASSERT(!((fe->common.fn_flags & ZEND_ACC_CTOR)
(gdb) bt
#0  zend_do_perform_implementation_check (unresolved_class=unresolved_class@entry=0x7fffffff9ad0, fe=0x0, proto=0x7ffff7a033b0) at /home/leigh/php-src/Zend/zend_inheritance.c:418
#1  0x000055555597af9e in report_variance_errors (ce=0x7ffff7a03660) at /home/leigh/php-src/Zend/zend_inheritance.c:2268
#2  zend_do_link_class (ce=ce@entry=0x7ffff7a03660, lc_parent_name=lc_parent_name@entry=0x55555617dfb0) at /home/leigh/php-src/Zend/zend_inheritance.c:2369
#3  0x0000555555923ef2 in do_bind_class (lcname=0x7ffff7a6d1e0, lc_parent_name=0x55555617dfb0) at /home/leigh/php-src/Zend/zend_compile.c:1076
#4  0x000055555598d155 in ZEND_DECLARE_CLASS_SPEC_CONST_HANDLER () at /home/leigh/php-src/Zend/zend_vm_execute.h:4342
#5  0x00005555559be1e3 in execute_ex (ex=0x7fffffff9ad0) at /home/leigh/php-src/Zend/zend_vm_execute.h:54252
#6  0x00005555559361f9 in zend_call_function (fci=fci@entry=0x7fffffff9d30, fci_cache=0x7ffff7a6d120, fci_cache@entry=0x7fffffff9d10) at /home/leigh/php-src/Zend/zend_execute_API.c:784
#7  0x00005555558426bc in zif_spl_autoload_call (execute_data=<optimised out>, return_value=<optimised out>) at /home/leigh/php-src/ext/spl/php_spl.c:450
#8  0x0000555555935ff7 in zend_call_function (fci=0x7fffffff9eb0, fci_cache=0x7fffffff9e90) at /home/leigh/php-src/Zend/zend_execute_API.c:799
#9  0x00005555559366f3 in zend_lookup_class_ex (name=<optimised out>, key=key@entry=0x0, flags=flags@entry=0) at /home/leigh/php-src/Zend/zend_execute_API.c:935
#10 0x00005555559368d9 in zend_lookup_class (name=<optimised out>) at /home/leigh/php-src/Zend/zend_execute_API.c:956
#11 0x000055555597aed7 in load_delayed_classes () at /home/leigh/php-src/Zend/zend_inheritance.c:2228
#12 zend_do_link_class (ce=ce@entry=0x7ffff7a033b0, lc_parent_name=lc_parent_name@entry=0x55555617df80) at /home/leigh/php-src/Zend/zend_inheritance.c:2365
#13 0x0000555555923ef2 in do_bind_class (lcname=0x7ffff7a6d1b0, lc_parent_name=0x55555617df80) at /home/leigh/php-src/Zend/zend_compile.c:1076
#14 0x000055555598d155 in ZEND_DECLARE_CLASS_SPEC_CONST_HANDLER () at /home/leigh/php-src/Zend/zend_vm_execute.h:4342
#15 0x00005555559be1e3 in execute_ex (ex=0x7fffffff9ad0) at /home/leigh/php-src/Zend/zend_vm_execute.h:54252
#16 0x00005555559361f9 in zend_call_function (fci=fci@entry=0x7fffffffa210, fci_cache=0x7ffff7a6d0e0, fci_cache@entry=0x7fffffffa1f0) at /home/leigh/php-src/Zend/zend_execute_API.c:784
#17 0x00005555558426bc in zif_spl_autoload_call (execute_data=<optimised out>, return_value=<optimised out>) at /home/leigh/php-src/ext/spl/php_spl.c:450
#18 0x0000555555935ff7 in zend_call_function (fci=0x7fffffffa390, fci_cache=0x7fffffffa370) at /home/leigh/php-src/Zend/zend_execute_API.c:799
#19 0x00005555559366f3 in zend_lookup_class_ex (name=name@entry=0x55555617d9b0, key=0x55555617dfb0, flags=flags@entry=512) at /home/leigh/php-src/Zend/zend_execute_API.c:935
#20 0x0000555555936f7c in zend_fetch_class_by_name (class_name=0x55555617d9b0, key=<optimised out>, fetch_type=fetch_type@entry=512) at /home/leigh/php-src/Zend/zend_execute_API.c:1365
#21 0x00005555559a4d77 in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER () at /home/leigh/php-src/Zend/zend_vm_execute.h:9116
#22 0x00005555559be07b in execute_ex (ex=0x7fffffff9ad0) at /home/leigh/php-src/Zend/zend_vm_execute.h:54692
#23 0x00005555559c4f4d in zend_execute (op_array=0x7ffff7a802a0, return_value=<optimised out>) at /home/leigh/php-src/Zend/zend_vm_execute.h:58019
#24 0x00005555559437b1 in zend_execute_scripts (type=type@entry=8, retval=0x7ffff7a82200, retval@entry=0x0, file_count=file_count@entry=3) at /home/leigh/php-src/Zend/zend.c:1643
#25 0x00005555558e5780 in php_execute_script (primary_file=<optimised out>) at /home/leigh/php-src/main/main.c:2585
#26 0x00005555559c6f6c in do_cli (argc=2, argv=0x555556172860) at /home/leigh/php-src/sapi/cli/php_cli.c:959
#27 0x000055555577e78d in main (argc=2, argv=0x555556172860) at /home/leigh/php-src/sapi/cli/php_cli.c:1350

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2019-10-08 13:24 UTC] nikic@php.net
-Assigned To: +Assigned To: nikic
 [2019-10-08 13:24 UTC] nikic@php.net 
This particular test script should generate a compile error because class X cannot be loaded but is needed for variance verification.

Here is a variant that fails with the same assertion but should compile file:

<?php

spl_autoload_register(function ($class) {
    if ($class == 'A') {
        class A
        {
            function m(): B {}
            function m2(): B {}
        }
    } elseif ($class == 'B') {
        class B extends A
        {
            function m(): X {}
            function m2(): Y {}
        }
    } elseif ($class == 'X') {
        class X extends B {} 
    } else { 
        class Y extends B {}
    } 
});

new B;
 
PHP Copyright © 2001-2021 The PHP Group
All rights reserved. 		Last updated: Sun Apr 11 03:01:23 2021 UTC