Segmentation fault on php 7.4.9

[Valeriy]

In php 7.4.9 a segfault occurs in this example.

This is a clone of the bug https://bugs.php.net/bug.php?id=79950.

Files for reproduction of the problem in the attachment.

gdb backtrace:

#0  0x000055bf9d77eeb0 in _build_trace_args (str=0x7ffeeeb70370, arg=0x7f42d865cdc8) at ./Zend/zend_exceptions.c:552
552 ./Zend/zend_exceptions.c: No such file or directory.
(gdb) bt
#0  0x000055bf9d77eeb0 in _build_trace_args (str=0x7ffeeeb70370, arg=0x7f42d865cdc8) at ./Zend/zend_exceptions.c:552
#1  _build_trace_string (num=<optimized out>, ht=<optimized out>, str=0x7ffeeeb70370) at ./Zend/zend_exceptions.c:608
#2  zim_exception_getTraceAsString (execute_data=<optimized out>, return_value=<optimized out>) at ./Zend/zend_exceptions.c:648
#3  0x000055bf9d751729 in zend_call_function (fci=fci@entry=0x7ffeeeb70550, fci_cache=0x7ffeeeb70420, fci_cache@entry=0x0)
    at ./Zend/zend_execute_API.c:826
#4  0x000055bf9d78082f in zim_exception___toString (execute_data=0x7f42d8613020, return_value=0x7ffeeeb707f0) at ./Zend/zend_exceptions.c:703
#5  0x000055bf9d751729 in zend_call_function (fci=fci@entry=0x7ffeeeb706e0, fci_cache=fci_cache@entry=0x7ffeeeb706c0)
    at ./Zend/zend_execute_API.c:826
#6  0x000055bf9d77d326 in zend_call_method (object=object@entry=0x7ffeeeb707d0, obj_ce=obj_ce@entry=0x55bf9dc3acf0, fn_proxy=<optimized out>, 
    function_name=function_name@entry=0x55bf9d84a900 "__tostring", function_name_len=function_name_len@entry=10, 
    retval_ptr=retval_ptr@entry=0x7ffeeeb707f0, param_count=0, arg1=0x0, arg2=0x0) at ./Zend/zend_interfaces.c:103
#7  0x000055bf9d5a98d8 in zend_exception_error (ex=0x7f42d867b281, severity=severity@entry=1) at ./Zend/zend_exceptions.c:1007
#8  0x000055bf9d5a9d57 in zend_throw_exception_internal (exception=exception@entry=0x0) at ./Zend/zend_exceptions.c:166
#9  0x000055bf9d751aba in zend_call_function (fci=fci@entry=0x7ffeeeb70960, fci_cache=<optimized out>, fci_cache@entry=0x0)
    at ./Zend/zend_execute_API.c:876
#10 0x000055bf9d751c65 in _call_user_function_ex (object=object@entry=0x0, function_name=function_name@entry=0x7ffeeeb709b0, 
    retval_ptr=retval_ptr@entry=0x7ffeeeb709c0, param_count=param_count@entry=1, params=params@entry=0x7ffeeeb709d0, 
    no_separation=no_separation@entry=1) at ./Zend/zend_execute_API.c:645
#11 0x000055bf9d5a8b0b in zend_user_exception_handler () at ./Zend/zend.c:1640
#12 0x000055bf9d7608df in zend_execute_scripts (type=type@entry=8, retval=retval@entry=0x0, file_count=file_count@entry=3)
    at ./Zend/zend.c:1676
#13 0x000055bf9d6fd250 in php_execute_script (primary_file=0x7ffeeeb72f40) at ./main/main.c:2621
#14 0x000055bf9d7f0824 in do_cli (argc=2, argv=0x55bf9db70990) at ./sapi/cli/php_cli.c:964
#15 0x000055bf9d5b96c3 in main (argc=2, argv=0x55bf9db70990) at ./sapi/cli/php_cli.c:135

‌

[Valeriy]

Still actual on php 7.4.10

Short example segfault.php:

<?php
$base = new EventBase();
$e = new Event($base, -1, Event::TIMEOUT, function () {
    throw new \Exception;
});
$e->addTimer(0);
$base->loop();

Segfault when run ./run.sh segfault.php

Output:

./run.sh: line 13: 137361 Segmentation fault      MALLOC_PERTURB_=$(($RANDOM % 255 + 1)) MALLOC_CHECK_=3 USE_ZEND_ALLOC=0 ZEND_DONT_UNLOAD_MODULES=1 php -n $sockets_option -dextension=event.so -dextension_dir=./.libs "$@"

Backtrace:

#0  0x000055565c60835a in instanceof_function ()
(gdb) bt
#0  0x000055565c60835a in instanceof_function ()
#1  0x000055565c461b11 in zend_exception_error ()
#2  0x000055565c612051 in zend_execute_scripts ()
#3  0x000055565c5b1a40 in php_execute_script ()
#4  0x000055565c69d252 in ?? ()
#5  0x000055565c478ca8 in ?? ()
#6  0x00007f6ff067b0b3 in __libc_start_main (main=0x55565c4788a0, argc=6, argv=0x7ffe47b79328, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, 
    stack_end=0x7ffe47b79318) at ../csu/libc-start.c:308
#7  0x000055565c478e4e in _start ()

‌

[Ruslan Osmanov]

As you pointed out in a direct Email, the error was in Event::dispatch and Event::loop methods where exception was re-thrown:

       if (EG(exception)) {
               ZVAL_OBJ(&exception_object, EG(exception));
               zend_throw_exception_object(&exception_object);
       }

I don't remember exactly what that workaround was for, but now it looks absolutely pointless to me. Without it, all tests pass in PHP 5.6, 7.1, 7.2, 7.3 as well as in 7.4.9. So I just removed that part.

Thank you!