laruence Thu, 26 Jan 2012 01:21:35 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=322770
Log: Fixed bug #60825 (Segfault when running symfony 2 tests) Bug: https://bugs.php.net/60825 (Critical) Segfault when running symfony 2 tests Changed paths: U php/php-src/branches/PHP_5_4/NEWS A php/php-src/branches/PHP_5_4/Zend/tests/bug60825.phpt U php/php-src/branches/PHP_5_4/Zend/zend_vm_def.h U php/php-src/branches/PHP_5_4/Zend/zend_vm_execute.h U php/php-src/trunk/NEWS
Modified: php/php-src/branches/PHP_5_4/NEWS =================================================================== --- php/php-src/branches/PHP_5_4/NEWS 2012-01-25 23:11:18 UTC (rev 322769) +++ php/php-src/branches/PHP_5_4/NEWS 2012-01-26 01:21:35 UTC (rev 322770) @@ -9,6 +9,8 @@ $_SERVER['REQUEST_TIME_FLOAT'] to include microsecond precision. (Patrick) . Fixed bug #60809 (TRAITS - PHPDoc Comment Style Bug). (Dmitry) . Fixed bug #60768 (Output buffer not discarded) (Mike) + . Fixed bug #60825 (Segfault when running symfony 2 tests). + (Dmitry, Laruence) - Hash . Fixed bug #60221 (Tiger hash output byte order) (Mike) Added: php/php-src/branches/PHP_5_4/Zend/tests/bug60825.phpt =================================================================== --- php/php-src/branches/PHP_5_4/Zend/tests/bug60825.phpt (rev 0) +++ php/php-src/branches/PHP_5_4/Zend/tests/bug60825.phpt 2012-01-26 01:21:35 UTC (rev 322770) @@ -0,0 +1,19 @@ +--TEST-- +Bug #60825 (Segfault when running symfony 2 tests) +--DESCRIPTION-- +run this with valgrind +--FILE-- +<?php +class test { + public static $x; + public function __toString() { + self::$x = $this; + return __FILE__; + } +} +$a = new test; +require_once $a; +debug_zval_dump(test::$x); +?> +--EXPECTF-- +string(%d) "%sbug60825.php" refcount(2) Modified: php/php-src/branches/PHP_5_4/Zend/zend_vm_def.h =================================================================== --- php/php-src/branches/PHP_5_4/Zend/zend_vm_def.h 2012-01-25 23:11:18 UTC (rev 322769) +++ php/php-src/branches/PHP_5_4/Zend/zend_vm_def.h 2012-01-26 01:21:35 UTC (rev 322770) @@ -2391,7 +2391,7 @@ CHECK_EXCEPTION(); ZEND_VM_NEXT_OPCODE(); } else if (OP2_TYPE != IS_CONST && - EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) && + EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) && zend_hash_num_elements(Z_ARRVAL_P(function_name)) == 2) { zend_class_entry *ce; zval **method = NULL; @@ -2399,15 +2399,15 @@ zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj); zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method); - + if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) { zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object"); } - + if (Z_TYPE_PP(method) != IS_STRING) { zend_error_noreturn(E_ERROR, "Second array member is not a valid method"); } - + if (Z_TYPE_PP(obj) == IS_STRING) { ce = zend_fetch_class_by_name(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj), NULL, 0 TSRMLS_CC); if (UNEXPECTED(ce == NULL)) { @@ -2415,7 +2415,7 @@ } EX(called_scope) = ce; EX(object) = NULL; - + if (ce->get_static_method) { EX(fbc) = ce->get_static_method(ce, Z_STRVAL_PP(method), Z_STRLEN_PP(method) TSRMLS_CC); } else { @@ -2429,7 +2429,7 @@ if (UNEXPECTED(EX(fbc) == NULL)) { zend_error_noreturn(E_ERROR, "Call to undefined method %s::%s()", Z_OBJ_CLASS_NAME_P(EX(object)), Z_STRVAL_PP(method)); } - + if ((EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) { EX(object) = NULL; } else { @@ -3693,17 +3693,18 @@ zend_op_array *new_op_array=NULL; zend_free_op free_op1; zval *inc_filename; - zval tmp_inc_filename; + zval *tmp_inc_filename = NULL; zend_bool failure_retval=0; SAVE_OPLINE(); inc_filename = GET_OP1_ZVAL_PTR(BP_VAR_R); if (inc_filename->type!=IS_STRING) { - ZVAL_COPY_VALUE(&tmp_inc_filename, inc_filename); - zval_copy_ctor(&tmp_inc_filename); - convert_to_string(&tmp_inc_filename); - inc_filename = &tmp_inc_filename; + MAKE_STD_ZVAL(tmp_inc_filename); + ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename); + zval_copy_ctor(tmp_inc_filename); + convert_to_string(tmp_inc_filename); + inc_filename = tmp_inc_filename; } if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) { @@ -3767,8 +3768,8 @@ EMPTY_SWITCH_DEFAULT_CASE() } } - if (inc_filename==&tmp_inc_filename) { - zval_dtor(&tmp_inc_filename); + if (tmp_inc_filename) { + zval_ptr_dtor(&tmp_inc_filename); } FREE_OP1(); if (UNEXPECTED(EG(exception) != NULL)) { @@ -4510,15 +4511,15 @@ if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */ || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */ && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) { - ZVAL_COPY_VALUE(&tmp, offset); - zval_copy_ctor(&tmp); - convert_to_long(&tmp); - offset = &tmp; + ZVAL_COPY_VALUE(&tmp, offset); + zval_copy_ctor(&tmp); + convert_to_long(&tmp); + offset = &tmp; } else { /* can not be converted to proper offset, return "not set" */ result = 0; - } } + } if (Z_TYPE_P(offset) == IS_LONG) { if (opline->extended_value & ZEND_ISSET) { if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) { Modified: php/php-src/branches/PHP_5_4/Zend/zend_vm_execute.h =================================================================== --- php/php-src/branches/PHP_5_4/Zend/zend_vm_execute.h 2012-01-25 23:11:18 UTC (rev 322769) +++ php/php-src/branches/PHP_5_4/Zend/zend_vm_execute.h 2012-01-26 01:21:35 UTC (rev 322770) @@ -2522,17 +2522,18 @@ zend_op_array *new_op_array=NULL; zval *inc_filename; - zval tmp_inc_filename; + zval *tmp_inc_filename = NULL; zend_bool failure_retval=0; SAVE_OPLINE(); inc_filename = opline->op1.zv; if (inc_filename->type!=IS_STRING) { - ZVAL_COPY_VALUE(&tmp_inc_filename, inc_filename); - zval_copy_ctor(&tmp_inc_filename); - convert_to_string(&tmp_inc_filename); - inc_filename = &tmp_inc_filename; + MAKE_STD_ZVAL(tmp_inc_filename); + ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename); + zval_copy_ctor(tmp_inc_filename); + convert_to_string(tmp_inc_filename); + inc_filename = tmp_inc_filename; } if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) { @@ -2596,8 +2597,8 @@ EMPTY_SWITCH_DEFAULT_CASE() } } - if (inc_filename==&tmp_inc_filename) { - zval_dtor(&tmp_inc_filename); + if (tmp_inc_filename) { + zval_ptr_dtor(&tmp_inc_filename); } if (UNEXPECTED(EG(exception) != NULL)) { @@ -6852,17 +6853,18 @@ zend_op_array *new_op_array=NULL; zend_free_op free_op1; zval *inc_filename; - zval tmp_inc_filename; + zval *tmp_inc_filename = NULL; zend_bool failure_retval=0; SAVE_OPLINE(); inc_filename = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC); if (inc_filename->type!=IS_STRING) { - ZVAL_COPY_VALUE(&tmp_inc_filename, inc_filename); - zval_copy_ctor(&tmp_inc_filename); - convert_to_string(&tmp_inc_filename); - inc_filename = &tmp_inc_filename; + MAKE_STD_ZVAL(tmp_inc_filename); + ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename); + zval_copy_ctor(tmp_inc_filename); + convert_to_string(tmp_inc_filename); + inc_filename = tmp_inc_filename; } if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) { @@ -6926,8 +6928,8 @@ EMPTY_SWITCH_DEFAULT_CASE() } } - if (inc_filename==&tmp_inc_filename) { - zval_dtor(&tmp_inc_filename); + if (tmp_inc_filename) { + zval_ptr_dtor(&tmp_inc_filename); } zval_dtor(free_op1.var); if (UNEXPECTED(EG(exception) != NULL)) { @@ -11209,17 +11211,18 @@ zend_op_array *new_op_array=NULL; zend_free_op free_op1; zval *inc_filename; - zval tmp_inc_filename; + zval *tmp_inc_filename = NULL; zend_bool failure_retval=0; SAVE_OPLINE(); inc_filename = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC); if (inc_filename->type!=IS_STRING) { - ZVAL_COPY_VALUE(&tmp_inc_filename, inc_filename); - zval_copy_ctor(&tmp_inc_filename); - convert_to_string(&tmp_inc_filename); - inc_filename = &tmp_inc_filename; + MAKE_STD_ZVAL(tmp_inc_filename); + ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename); + zval_copy_ctor(tmp_inc_filename); + convert_to_string(tmp_inc_filename); + inc_filename = tmp_inc_filename; } if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) { @@ -11283,8 +11286,8 @@ EMPTY_SWITCH_DEFAULT_CASE() } } - if (inc_filename==&tmp_inc_filename) { - zval_dtor(&tmp_inc_filename); + if (tmp_inc_filename) { + zval_ptr_dtor(&tmp_inc_filename); } if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; if (UNEXPECTED(EG(exception) != NULL)) { @@ -14038,15 +14041,15 @@ if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */ || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */ && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) { - ZVAL_COPY_VALUE(&tmp, offset); - zval_copy_ctor(&tmp); - convert_to_long(&tmp); - offset = &tmp; + ZVAL_COPY_VALUE(&tmp, offset); + zval_copy_ctor(&tmp); + convert_to_long(&tmp); + offset = &tmp; } else { /* can not be converted to proper offset, return "not set" */ result = 0; - } } + } if (Z_TYPE_P(offset) == IS_LONG) { if (opline->extended_value & ZEND_ISSET) { if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) { @@ -15951,15 +15954,15 @@ if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */ || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */ && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) { - ZVAL_COPY_VALUE(&tmp, offset); - zval_copy_ctor(&tmp); - convert_to_long(&tmp); - offset = &tmp; + ZVAL_COPY_VALUE(&tmp, offset); + zval_copy_ctor(&tmp); + convert_to_long(&tmp); + offset = &tmp; } else { /* can not be converted to proper offset, return "not set" */ result = 0; - } } + } if (Z_TYPE_P(offset) == IS_LONG) { if (opline->extended_value & ZEND_ISSET) { if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) { @@ -18222,15 +18225,15 @@ if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */ || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */ && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) { - ZVAL_COPY_VALUE(&tmp, offset); - zval_copy_ctor(&tmp); - convert_to_long(&tmp); - offset = &tmp; + ZVAL_COPY_VALUE(&tmp, offset); + zval_copy_ctor(&tmp); + convert_to_long(&tmp); + offset = &tmp; } else { /* can not be converted to proper offset, return "not set" */ result = 0; - } } + } if (Z_TYPE_P(offset) == IS_LONG) { if (opline->extended_value & ZEND_ISSET) { if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) { @@ -21143,15 +21146,15 @@ if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */ || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */ && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) { - ZVAL_COPY_VALUE(&tmp, offset); - zval_copy_ctor(&tmp); - convert_to_long(&tmp); - offset = &tmp; + ZVAL_COPY_VALUE(&tmp, offset); + zval_copy_ctor(&tmp); + convert_to_long(&tmp); + offset = &tmp; } else { /* can not be converted to proper offset, return "not set" */ result = 0; - } } + } if (Z_TYPE_P(offset) == IS_LONG) { if (opline->extended_value & ZEND_ISSET) { if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) { @@ -22477,15 +22480,15 @@ if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */ || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */ && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) { - ZVAL_COPY_VALUE(&tmp, offset); - zval_copy_ctor(&tmp); - convert_to_long(&tmp); - offset = &tmp; + ZVAL_COPY_VALUE(&tmp, offset); + zval_copy_ctor(&tmp); + convert_to_long(&tmp); + offset = &tmp; } else { /* can not be converted to proper offset, return "not set" */ result = 0; - } } + } if (Z_TYPE_P(offset) == IS_LONG) { if (opline->extended_value & ZEND_ISSET) { if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) { @@ -23634,15 +23637,15 @@ if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */ || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */ && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) { - ZVAL_COPY_VALUE(&tmp, offset); - zval_copy_ctor(&tmp); - convert_to_long(&tmp); - offset = &tmp; + ZVAL_COPY_VALUE(&tmp, offset); + zval_copy_ctor(&tmp); + convert_to_long(&tmp); + offset = &tmp; } else { /* can not be converted to proper offset, return "not set" */ result = 0; - } } + } if (Z_TYPE_P(offset) == IS_LONG) { if (opline->extended_value & ZEND_ISSET) { if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) { @@ -24791,15 +24794,15 @@ if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */ || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */ && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) { - ZVAL_COPY_VALUE(&tmp, offset); - zval_copy_ctor(&tmp); - convert_to_long(&tmp); - offset = &tmp; + ZVAL_COPY_VALUE(&tmp, offset); + zval_copy_ctor(&tmp); + convert_to_long(&tmp); + offset = &tmp; } else { /* can not be converted to proper offset, return "not set" */ result = 0; - } } + } if (Z_TYPE_P(offset) == IS_LONG) { if (opline->extended_value & ZEND_ISSET) { if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) { @@ -26214,15 +26217,15 @@ if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */ || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */ && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) { - ZVAL_COPY_VALUE(&tmp, offset); - zval_copy_ctor(&tmp); - convert_to_long(&tmp); - offset = &tmp; + ZVAL_COPY_VALUE(&tmp, offset); + zval_copy_ctor(&tmp); + convert_to_long(&tmp); + offset = &tmp; } else { /* can not be converted to proper offset, return "not set" */ result = 0; - } } + } if (Z_TYPE_P(offset) == IS_LONG) { if (opline->extended_value & ZEND_ISSET) { if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) { @@ -27061,17 +27064,18 @@ zend_op_array *new_op_array=NULL; zval *inc_filename; - zval tmp_inc_filename; + zval *tmp_inc_filename = NULL; zend_bool failure_retval=0; SAVE_OPLINE(); inc_filename = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC); if (inc_filename->type!=IS_STRING) { - ZVAL_COPY_VALUE(&tmp_inc_filename, inc_filename); - zval_copy_ctor(&tmp_inc_filename); - convert_to_string(&tmp_inc_filename); - inc_filename = &tmp_inc_filename; + MAKE_STD_ZVAL(tmp_inc_filename); + ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename); + zval_copy_ctor(tmp_inc_filename); + convert_to_string(tmp_inc_filename); + inc_filename = tmp_inc_filename; } if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) { @@ -27135,8 +27139,8 @@ EMPTY_SWITCH_DEFAULT_CASE() } } - if (inc_filename==&tmp_inc_filename) { - zval_dtor(&tmp_inc_filename); + if (tmp_inc_filename) { + zval_ptr_dtor(&tmp_inc_filename); } if (UNEXPECTED(EG(exception) != NULL)) { @@ -29529,15 +29533,15 @@ if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */ || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */ && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) { - ZVAL_COPY_VALUE(&tmp, offset); - zval_copy_ctor(&tmp); - convert_to_long(&tmp); - offset = &tmp; + ZVAL_COPY_VALUE(&tmp, offset); + zval_copy_ctor(&tmp); + convert_to_long(&tmp); + offset = &tmp; } else { /* can not be converted to proper offset, return "not set" */ result = 0; - } } + } if (Z_TYPE_P(offset) == IS_LONG) { if (opline->extended_value & ZEND_ISSET) { if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) { @@ -31316,15 +31320,15 @@ if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */ || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */ && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) { - ZVAL_COPY_VALUE(&tmp, offset); - zval_copy_ctor(&tmp); - convert_to_long(&tmp); - offset = &tmp; + ZVAL_COPY_VALUE(&tmp, offset); + zval_copy_ctor(&tmp); + convert_to_long(&tmp); + offset = &tmp; } else { /* can not be converted to proper offset, return "not set" */ result = 0; - } } + } if (Z_TYPE_P(offset) == IS_LONG) { if (opline->extended_value & ZEND_ISSET) { if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) { @@ -33460,15 +33464,15 @@ if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */ || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */ && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) { - ZVAL_COPY_VALUE(&tmp, offset); - zval_copy_ctor(&tmp); - convert_to_long(&tmp); - offset = &tmp; + ZVAL_COPY_VALUE(&tmp, offset); + zval_copy_ctor(&tmp); + convert_to_long(&tmp); + offset = &tmp; } else { /* can not be converted to proper offset, return "not set" */ result = 0; - } } + } if (Z_TYPE_P(offset) == IS_LONG) { if (opline->extended_value & ZEND_ISSET) { if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) { @@ -36118,15 +36122,15 @@ if (Z_TYPE_P(offset) <= IS_BOOL /* simple scalar types */ || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */ && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) { - ZVAL_COPY_VALUE(&tmp, offset); - zval_copy_ctor(&tmp); - convert_to_long(&tmp); - offset = &tmp; + ZVAL_COPY_VALUE(&tmp, offset); + zval_copy_ctor(&tmp); + convert_to_long(&tmp); + offset = &tmp; } else { /* can not be converted to proper offset, return "not set" */ result = 0; - } } + } if (Z_TYPE_P(offset) == IS_LONG) { if (opline->extended_value & ZEND_ISSET) { if (offset->value.lval >= 0 && offset->value.lval < Z_STRLEN_PP(container)) { Modified: php/php-src/trunk/NEWS =================================================================== --- php/php-src/trunk/NEWS 2012-01-25 23:11:18 UTC (rev 322769) +++ php/php-src/trunk/NEWS 2012-01-26 01:21:35 UTC (rev 322770) @@ -8,8 +8,6 @@ - Core: . Fixed bug #60573 (type hinting with "self" keyword causes weird errors). (Laruence) - . Fixed bug #60825 (Segfault when running symfony 2 tests). - (Dmitry, Laruence) - cURL: . Added support for CURLOPT_FTP_RESPONSE_TIMEOUT, CURLOPT_APPEND,
-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php