Edit report at https://bugs.php.net/bug.php?id=61998&edit=1
ID: 61998
Comment by: reeze dot xia at gmail dot com
Reported by: rbarbosa at revelex dot com
Summary: Using traits with method aliases appears to result
in crash during execution.
Status: Feedback
Type: Bug
Package: Reproducible crash
Operating System: Redhat Linux - Kernel 2.6.18
PHP Version: 5.4.3
Block user comment: N
Private report: N
New Comment:
Thanks ron for your test script. I've make a minimal reproducible one below:
In Class1:
newFunc was referred to T::func
func was itself (by overriding);
In T
func was referred by T and itself;
--- since class was destroyed by reverse order --
1. Destroy Tï¼ will not release the function name defined in trait. since
the Class1 referred to this function.
2. Destroy Class1ï¼it will destroy the alias name since the aliased
function name was referred to it.(this leave the original function name
in trait unreleased). after destroy function table it will destroy
alias info. but alias was already destroyed in function table releasing
phrase.
This cause double free(crash).
Solutions:
1. Copy the whole function will solve the problem. but it was too heavy.
2. Don't change the aliases function's name, since function call are always
lookup by hash key name.
but it will make reflection unhappy and can't throw right error message for
function.
3. Make a reference in function table if trait function was overrided to avoid
releasing problem.
This need to change reflection ignore it.get_defined_functions() &
get_delcared_clesses()
use this trick to filter special entry. so we need to change
ReflectionClass::getMethods().
In summary I prefer option 3. What do you think?
and I made PR: https://github.com/php/php-src/pull/83
------ Test script ---------------
<?php
class Class1 {
use T {
func as newFunc;
}
public function func() { // <------------ if this override trait method and
the method get aliased will lead crash
echo "From Class1::func\n";
}
}
class Class2 {
use T;
}
trait T { // <------------------------------ declare after the Class1 and it
will be destroy before Class1
public function func() {
echo "From trait T\n";
}
}
Previous Comments:
------------------------------------------------------------------------
[2012-05-11 01:04:06] [email protected]
Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves.
A proper reproducing script starts with <?php and ends with ?>,
is max. 10-20 lines long and does not require any external
resources such as databases, etc. If the script requires a
database to demonstrate the issue, please make sure it creates
all necessary tables, stored procedures etc.
Please avoid embedding huge scripts into the report.
------------------------------------------------------------------------
[2012-05-10 16:02:14] rbarbosa at revelex dot com
Description:
------------
During testing in out application under development we began experiencing
crashes in the PHP module with an error indicating "zend_mm_heap corrupted."
As this was occurring in a larger application, we noticed it did not begin
occurring until we include method aliases in a trait we'd written.
We loaded a debug build of PHP 5.4.3 and observed the following error message:
[Thu May 10 10:46:13 2012] Script:
'/home/xxxxxxx/public_html/www/app/portal.rvlx'
---------------------------------------
/opt/src/apache2.2/php-5.4.3/Zend/zend_opcode.c(235) : Block 0x09ef4914 status:
Invalid pointer: ((size=0x00000038) != (next.prev=0x00000420))
---------------------------------------
We then developed a small sandbox test which included a simple script with a
trait with method a alias. This did not yield the same error message, but it
did indicate a failure with the same line of code, zend_opcode.c:235. It also
referenced another file with a different error:
[Thu May 10 11:16:36 2012] Script:
'/home/xxxxxxx/public_html/www/sites/traitBug/trait_bug_test.php'
Zend/zend_language_scanner.l(1889) : Freeing 0xB7EFAFD4 (12 bytes),
script=/home/crussell/public_html/www/sites/traitBug/trait_bug_test.php
=== Total 1 memory leaks detected ===
[Thu May 10 11:16:36 2012] Script:
'/home/xxxxxxx/public_html/www/sites/traitBug/trait_bug_test.php'
---------------------------------------
/opt/src/apache2.2/php-5.4.3/Zend/zend_opcode.c(235) : Block 0xb7ef87d4 status:
Beginning: Cached
Freed (invalid)
Start: OK
End: OK
---------------------------------------
Two adjustments to the scripts would clear this error. Either eliminating the
use of the autoloader and performing a "require_once" statement in the code, or
eliminating the method alias. Either of those 2 actions eliminates this error
from our logs.
Both trait method aliasing and autoloader functionality are vital to our
application, so we're eager to see this issue resolved.
When executed in our application, this error results in immediate closure of
the apache connection and a zero length response.
Test script:
---------------
I do not have a test script, but I do have a zip file with a directory
containing the trait files and executable PHP code to replicate this issue.
Please contact me at my email address [email protected], when the bug has
been assigned and I will send you the archive with test scripts.
Expected result:
----------------
Expectation is that the script would execute without any errors in the apache
logs.
Actual result:
--------------
See the bug description.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=61998&edit=1
