[1.2.0 - 1.2.3] Segfault @ PriorityQueue #106
Description
Segfault on call gc_collect_cycles(). Problem is reproduced on 1.2.0 - 1.2.3 versions.
Installed via pecl (1.2.0-1.2.3) and compiled from sources
php -v:
PHP 7.1.11-1+ubuntu17.04.1+deb.sury.org+1 (cli) (built: Oct 27 2017 13:50:28) ( NTS )
Copyright (c) 1997-2017 The PHP Group
Zend Engine v3.1.0, Copyright (c) 1998-2017 Zend Technologies
with Zend OPcache v7.1.11-1+ubuntu17.04.1+deb.sury.org+1, Copyright (c) 1999-2017, by Zend Technologies
ds:
ds support => enabled
ds version => 1.2.3
PHP:
ad@ad-desktop:~/php/php-ds$ cat priority-queue-segfault.php
<?php
$queue = new Ds\PriorityQueue();
gc_collect_cycles();gdb output:
(gdb) run priority-queue-segfault.php
Starting program: /usr/bin/php priority-queue-segfault.php
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Program received signal SIGSEGV, Segmentation fault.
ds_priority_queue_copy_gc (gc_size=0x7fffffffa3f4, gc_data=0x7fffffffa3f8, obj=0x7ffff386b140) at /home/ad/extension/src/php/handlers/php_priority_queue_handlers.c:51
51 ZVAL_COPY_VALUE(target++, value);
(gdb) bt
#0 ds_priority_queue_copy_gc (gc_size=0x7fffffffa3f4, gc_data=0x7fffffffa3f8, obj=0x7ffff386b140) at /home/ad/extension/src/php/handlers/php_priority_queue_handlers.c:51
#1 php_ds_priority_queue_get_gc (object=<optimized out>, gc_data=0x7fffffffa3f8, gc_size=0x7fffffffa3f4) at /home/ad/extension/src/php/handlers/php_priority_queue_handlers.c:70
#2 0x00005555557ec9f9 in gc_mark_grey (ref=<optimized out>) at ./Zend/zend_gc.c:499
#3 0x00005555557eda80 in gc_mark_roots () at ./Zend/zend_gc.c:598
#4 zend_gc_collect_cycles () at ./Zend/zend_gc.c:1072
#5 0x00005555557d941d in zif_gc_collect_cycles (execute_data=<optimized out>, return_value=0x7fffffffa510) at ./Zend/zend_builtin_functions.c:476
#6 0x000055555581ef9a in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER () at ./Zend/zend_vm_execute.h:628
#7 0x000055555580d7eb in execute_ex (ex=<optimized out>) at ./Zend/zend_vm_execute.h:429
#8 0x0000555555868a38 in zend_execute (op_array=op_array@entry=0x7ffff3882000, return_value=return_value@entry=0x7ffff38772c0) at ./Zend/zend_vm_execute.h:474
#9 0x00005555557c3b33 in zend_execute_scripts (type=-209637328, type@entry=8, retval=0x7ffff38772c0, retval@entry=0x0, file_count=file_count@entry=3) at ./Zend/zend.c:1482
#10 0x000055555575fb80 in php_execute_script (primary_file=0x7fffffffcb30) at ./main/main.c:2577
#11 0x000055555586aca0 in do_cli (argc=2, argv=0x555555be2140) at ./sapi/cli/php_cli.c:993
#12 0x000055555563b4d9 in main (argc=2, argv=0x555555be2140) at ./sapi/cli/php_cli.c:1381
(gdb)