Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Assertion failure Zend/zend_hash.c:1543 #17416

Open
YuanchengJiang opened this issue Jan 9, 2025 · 1 comment
Open

Assertion failure Zend/zend_hash.c:1543 #17416

YuanchengJiang opened this issue Jan 9, 2025 · 1 comment

Comments

@YuanchengJiang
Copy link

Description

The following code:

<?php
function Error2Exception($errno, $errstr, $errfile, $errline)
{
throw new MyException($errstr, $errno);
}
set_error_handler('Error2Exception');
function bar(array &$a): ?bool {
foreach ($a as $key => $val) {
if ($val === 2) {
unset($a[$fusion]);
}
}
}
function foo($a, bool $b): bool {
do {
$res = bar($a);
} while ($res === null && $n !== $n2);
}
foo([2,'a'=>5], false);

Resulted in this output:

php: /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:1543: zend_result zend_hash_del(HashTable *, zend_string *): Assertion `(zend_gc_refcount(&(ht)->gc) == 1) || ((ht)->u.flags & (1<<6))' failed.
Aborted (core dumped)

PHP Version

nightly

Operating System

No response

@arnaud-lb
Copy link
Member

Minimal reproducer:

function Error2Exception($errno, $errstr, $errfile, $errline) {
    throw null;
}

set_error_handler('Error2Exception');

function bar(array $a) {
    unset($a[$fusion]);
}

bar([2]);

$a is separated at the beginning of ZEND_UNSET_DIM, but new references are created when collecting arguments for the exception backtrace, before actually modifying the array.

This would be fixed by delaying error handling (#12805).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants