Segfault with 7.2.0RC3

[remicollet]

No issue with 7.2.0RC2

Related to http://git.php.net/?p=php-src.git;a=commitdiff;h=10a7f2cf6241da934d3b1d441df89a5e3f3d3e5a

(gdb) bt
#0  zend_string_release (s=0x59ca3a48) at /usr/src/debug/php-7.2.0RC3/Zend/zend_string.h:289
#1  zend_function_dtor (zv=<optimized out>) at /usr/src/debug/php-7.2.0RC3/Zend/zend_opcode.c:158
#2  0x000055a33a7bde37 in _zend_hash_del_el_ex (prev=0x0, p=0x55a33b5ae880, idx=879, ht=0x55a33b5993d0) at /usr/src/debug/php-7.2.0RC3/Zend/zend_hash.c:996
#3  zend_hash_str_del (ht=0x55a33b5993d0, str=str@entry=0x7ff1fa738bc0 "timecop_orig_date_create_immutable_from_format", len=46)
    at /usr/src/debug/php-7.2.0RC3/Zend/zend_hash.c:1174
#4  0x00007ff1fa73506e in timecop_func_override_clear () at /work/GIT/php-timecop/timecop_php7.c:638
#5  zm_deactivate_timecop (type=<optimized out>, module_number=<optimized out>) at /work/GIT/php-timecop/timecop_php7.c:393
#6  0x000055a33a7b37a4 in zend_deactivate_modules () at /usr/src/debug/php-7.2.0RC3/Zend/zend_API.c:2637
#7  0x000055a33a746a15 in php_request_shutdown (dummy=<optimized out>) at /usr/src/debug/php-7.2.0RC3/main/main.c:1878
#8  0x000055a33a85fc13 in do_cli (argc=76, argv=0x55a33b598670) at /usr/src/debug/php-7.2.0RC3/sapi/cli/php_cli.c:1178
#9  0x000055a33a602c0b in main (argc=76, argv=0x55a33b598670) at /usr/src/debug/php-7.2.0RC3/sapi/cli/php_cli.c:1404

[dstogov]

PHP-7.0.RC2 added code to remove leaking arg_info structures.
Unfortunately, this triggered a bug in timecop extension.
It tries to delete functions at https://github.com/hnw/php-timecop/blob/master/timecop_php7.c#L634 , but PHP doesn't expect that the same internal function may be referenced twice.
It's possible to fix this, by clearing arg_info before deletion.

if (zf_orig->type == ZEND_INTERNAL_FUNCTION) {
zf->common.arg_info = NULL;
}

[remicollet]

A different backtrace:

(gdb) bt
#0  zend_get_class_fetch_type (name=name@entry=0x7f1000435454) at /usr/src/debug/php-7.2.0RC3/Zend/zend_compile.c:1461
#1  0x000055b88222a3f5 in zend_fetch_class (class_name=class_name@entry=0x7f1000435454, fetch_type=fetch_type@entry=132)
    at /usr/src/debug/php-7.2.0RC3/Zend/zend_execute_API.c:1391
#2  0x000055b8822e0981 in zend_check_type (is_return_type=0 '\000', scope=<optimized out>, default_value=0x0, cache_slot=<synthetic pointer>, ce=<synthetic pointer>, 
    arg=0x7f10de41d3c0, type=139706700616789) at /usr/src/debug/php-7.2.0RC3/Zend/zend_execute.c:837
#3  zend_verify_arg_type (cache_slot=<synthetic pointer>, default_value=0x0, arg=0x7f10de41d3c0, arg_num=1, zf=0x55b8842d9d30)
    at /usr/src/debug/php-7.2.0RC3/Zend/zend_execute.c:885
#4  zend_verify_internal_arg_types (fbc=<optimized out>, call=0x7f10de41d370) at /usr/src/debug/php-7.2.0RC3/Zend/zend_execute.c:902
#5  0x000055b8822eb056 in ZEND_DO_FCALL_SPEC_RETVAL_USED_HANDLER () at /usr/src/debug/php-7.2.0RC3/Zend/zend_vm_execute.h:1022
#6  execute_ex (ex=0x7f1000435454) at /usr/src/debug/php-7.2.0RC3/Zend/zend_vm_execute.h:59755
#7  0x000055b8822eb4be in zend_execute (op_array=op_array@entry=0x7f10de480380, return_value=return_value@entry=0x7f10de498900)
    at /usr/src/debug/php-7.2.0RC3/Zend/zend_vm_execute.h:63763
#8  0x000055b882239c13 in zend_execute_scripts (type=-566112208, type@entry=8, retval=0x7f10de498900, retval@entry=0x0, file_count=file_count@entry=3)
    at /usr/src/debug/php-7.2.0RC3/Zend/zend.c:1496
#9  0x000055b8821d4d98 in php_execute_script (primary_file=0x7ffd27480a20) at /usr/src/debug/php-7.2.0RC3/main/main.c:2590
#10 0x000055b8822ed87f in do_cli (argc=68, argv=0x55b8842ad790) at /usr/src/debug/php-7.2.0RC3/sapi/cli/php_cli.c:1011
#11 0x000055b88208fc0b in main (argc=68, argv=0x55b8842ad790) at /usr/src/debug/php-7.2.0RC3/sapi/cli/php_cli.c:1404

[remicollet]

Any idea about this issue ?
The dmitry idea indeed solves the segfault, but break test suite

[remicollet]

Thanks a lot !

(I confirm, build and test suite ok)

[SMillerDev]

Could I request a release with this fix? Otherwise homebrew needs to start messing with HEAD formulae.

[hnw]

@remicollet Thanks for confirming!

@SMillerDev I released 1.2.10 on GitHub and PECL. This should solve the issue.