0001329: While printing out a stack with and function parameters, XDebug reads uninitialized zvals or free()d memory

Notes
(0003650) tyson (reporter) 2016-07-21 21:04	I also see this error when xdebug.collect_params = 1 (along with other errors) ==1== ==1== Use of uninitialised value of size 8 ==1== at 0x8DE8A3C: xdebug_var_synopsis (xdebug_var.c:1208) ==1== by 0x8DE8CD8: xdebug_get_zval_synopsis (xdebug_var.c:1285) ==1== by 0x8DDE4E9: add_single_value (xdebug_stack.c:389) ==1== by 0x8DDE9FC: xdebug_append_printable_stack (xdebug_stack.c:483) ==1== by 0x8DDEF71: get_printable_stack (xdebug_stack.c:580) ==1== by 0x8DDFC05: xdebug_error_cb (xdebug_stack.c:805) ==1== by 0x7A57CA: zend_error (zend.c:1154) ==1== by 0x7F0434: zend_std_read_property (zend_object_handlers.c:621) ==1== by 0x83EBBC: ZEND_FETCH_OBJ_R_SPEC_UNUSED_CONST_HANDLER (zend_vm_execute.h:23539) ==1== by 0x80846C: ZEND_USER_OPCODE_SPEC_HANDLER (zend_vm_execute.h:1568) ==1== by 0x80481A: execute_ex (zend_vm_execute.h:417) ==1== by 0x8DC3CF9: xdebug_execute_ex (xdebug.c:1890)

(0003651) tyson (reporter) 2016-07-21 21:25	I thought it might have been related to call_user_func*, but it happened even without the dynamic method name. A smaller version of the test case is test6.php

(0003652) tyson (reporter) 2016-07-21 21:45	I also tried test6.php with the latest commit on github, and still got errors ( https://github.com/xdebug/xdebug/commit/bcb45acb6c828ccf9e217a1f58db92658c6650cb [^] ) https://github.com/TysonAndre-ContinuousIntegration/xdebug_segfault/blob/master/valgrind_output_for_xdebug-bcb45ac.txt [^]

(0003653) derick (administrator) 2016-07-21 21:49	I'm looking at this, and also seeing the crash. Albeit in a different way. If you could work on continuing making the test case smaller, that'd be a great help.

(0003654) tyson (reporter) 2016-07-21 22:09 edited on: 2016-07-21 22:09	Contents of test8.php after minimization between the quotes: ``` <?php class client { public function __call($method, $params) { echo $this->_url; } } function main($a) { $service = new client(); list($aaaa) = $service->callSomeMagicMethod_1($xxxxxxx); } main(true); ``` php.ini is the same as my other examples: ``` [PHP] error_reporting = E_ALL \| E_STRICT display_errors = On log_errors = On report_memleaks = On extension_dir="/usr/local/lib/php/20151012-debug" include_path="." [xdebug] zend_extension="/usr/local/lib/php/20151012-debug/xdebug.so" xdebug.profiler_enable=0 xdebug.collect_params=3 xdebug.remote_enable=1 ``` Valgrind output for me: https://github.com/TysonAndre-ContinuousIntegration/xdebug_segfault/blob/master/valgrind_test8-for-xdebug-bcb45ac.txt [^]

(0003655) tyson (reporter) 2016-07-21 22:13	Also, did you want the ./configure script options to be "smaller" (And if so, what you call a standard config / compiler flags)?

(0003656) derick (administrator) 2016-07-21 22:24	No, I'm fine. Thanks. The test cases I have now are good enough.

(0004079) derick (administrator) 2016-12-17 19:21	I have an inkling that https://github.com/xdebug/xdebug/commit/90efb3aada7b0423a86462d10d6758ca3c384e75 [^] might have fixed this - would you mind trying with the latest Git version?

(0004080) tyson (reporter) 2016-12-18 02:36 edited on: 2016-12-18 02:39	It seems like it's fixed. (Will reopen this if the code the examples were derived from encounters different bugs) I ran all 4 tests cases in https://github.com/TysonAndre-ContinuousIntegration/xdebug_segfault [^] again with php 7.0.14. The crashes are fixed in the current xdebug master branch (bb535ed, which includes 90efb3aa) The issue description could be amended to include 7.0.5-7.0.14 and xdebug 2.4.0-2.5.0 (I was able to reproduce the crashes/allocator error with xdebug 2.5.0 and php 7.0.14. There were no errors with xdebug master(2.6-dev?) and php 7.0.14)

(0004091) derick (administrator) 2016-12-19 12:49	Okay, let me close this as fixed then. Please create a new issue if you find further crashes etc.

Issue History
Date Modified	Username	Field	Change
2016-07-21 20:25	tyson	New Issue
2016-07-21 20:25	tyson	File Added: xdebug_segfault-master.zip
2016-07-21 21:04	tyson	Note Added: 0003650
2016-07-21 21:25	tyson	Note Added: 0003651
2016-07-21 21:25	tyson	File Added: test6.php
2016-07-21 21:45	tyson	Note Added: 0003652
2016-07-21 21:49	derick	Note Added: 0003653
2016-07-21 22:09	tyson	Note Added: 0003654
2016-07-21 22:09	tyson	Note Edited: 0003654	View Revisions
2016-07-21 22:10	tyson	File Added: test8.php
2016-07-21 22:13	tyson	Note Added: 0003655
2016-07-21 22:24	derick	Note Added: 0003656
2016-07-31 13:36	derick	Category	Usage problems => Usage problems (Crashes)
2016-07-31 13:38	derick	Category	Usage problems (Crashes) => Usage problems (Wrong Results)
2016-12-04 16:06	derick	Assigned To	=> derick
2016-12-04 16:06	derick	Status	new => acknowledged
2016-12-04 17:40	derick	Status	acknowledged => confirmed
2016-12-17 17:12	derick	Severity	major => crash
2016-12-17 19:21	derick	Note Added: 0004079
2016-12-17 19:21	derick	Status	confirmed => feedback
2016-12-18 02:36	tyson	Note Added: 0004080
2016-12-18 02:36	tyson	Status	feedback => assigned
2016-12-18 02:38	tyson	Note Edited: 0004080	View Revisions
2016-12-18 02:39	tyson	Note Edited: 0004080	View Revisions
2016-12-19 12:49	derick	Note Added: 0004091
2016-12-19 12:49	derick	Status	assigned => closed
2016-12-19 12:49	derick	Resolution	open => fixed
2016-12-19 12:49	derick	Fixed in Version	=> 2.5.1

Relationships