Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Assertion failure Zend/zend_hash.c:1543 #17416

Open
YuanchengJiang opened this issue Jan 9, 2025 · 1 comment
Open

Assertion failure Zend/zend_hash.c:1543 #17416

YuanchengJiang opened this issue Jan 9, 2025 · 1 comment

Comments

@YuanchengJiang
Copy link

Description

The following code:

<?php
function Error2Exception($errno, $errstr, $errfile, $errline)
{
throw new MyException($errstr, $errno);
}
set_error_handler('Error2Exception');
function bar(array &$a): ?bool {
foreach ($a as $key => $val) {
if ($val === 2) {
unset($a[$fusion]);
}
}
}
function foo($a, bool $b): bool {
do {
$res = bar($a);
} while ($res === null && $n !== $n2);
}
foo([2,'a'=>5], false);

Resulted in this output:

php: /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:1543: zend_result zend_hash_del(HashTable *, zend_string *): Assertion `(zend_gc_refcount(&(ht)->gc) == 1) || ((ht)->u.flags & (1<<6))' failed.
Aborted (core dumped)

PHP Version

nightly

Operating System

No response

@arnaud-lb
Copy link
Member

Minimal reproducer:

function Error2Exception($errno, $errstr, $errfile, $errline) {
    throw null;
}

set_error_handler('Error2Exception');

function bar(array $a) {
    unset($a[$fusion]);
}

bar([2]);

$a is separated at the beginning of ZEND_UNSET_DIM, but new references are created when collecting arguments for the exception backtrace, before actually modifying the array.

This would be fixed by delaying error handling (#12805).

# for free to join this conversation on GitHub. Already have an account? # to comment
Projects
None yet
Development

No branches or pull requests

3 participants