View Issue Details

IDProjectCategoryView StatusLast Update
0001896XdebugUncategorizedpublic2020-11-27 16:58
Reporterserbancatalin18 Assigned Toderick  
PrioritynormalSeveritycrashReproducibilityalways
Status closedResolutionfixed 
Product Version3.0.0 
Target Version3.0devFixed in Version3.0.1 
Summary0001896: Segfault with closures that are not created from user code
Descriptiongdb trace attached

The following script gives Segmentation fault.
Removing xdebug or running php -n returns ok.

$a = new \ReflectionClass(\stdClass::class);
$b = \Closure::fromCallable([$a, 'newInstanceWithoutConstructor']);
$c = $b();


Steps To ReproduceCreate a php file with
$a = new \ReflectionClass(\stdClass::class);
$b = \Closure::fromCallable([$a, 'newInstanceWithoutConstructor']);
$c = $b();

Run from cli
Additional Informationphp -v
PHP 7.3.9 (cli) (built: Sep 12 2019 10:23:43) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.3.9, Copyright (c) 1998-2018 Zend Technologies
    with Zend OPcache v7.3.9, Copyright (c) 1999-2018, by Zend Technologies
    with Xdebug v3.0.0, Copyright (c) 2002-2020, by Derick Rethans

cat /proc/version
Linux version 5.4.39-linuxkit (root@buildkitsandbox) (gcc version 9.2.0 (Alpine 9.2.0)) #1 SMP Fri May 8 23:03:06 UTC 2020
TagsNo tags attached.
Operating System
PHP Version7.3.5-7.3.9

Activities

serbancatalin18

2020-11-26 17:24

reporter  

gdb-trace.txt (4,707 bytes)   
gdb --args php test.php
GNU gdb (Debian 8.2.1-2+b3) 8.2.1
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from php...(no debugging symbols found)...done.
(gdb) run
Starting program: /usr/local/bin/php test.php
warning: Error disabling address space randomization: Operation not permitted
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
__strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:65
65      ../sysdeps/x86_64/multiarch/strlen-avx2.S: No such file or directory.
(gdb) bt full
#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:65
No locals.
#1  0x00005579afbb3c10 in ?? ()
No symbol table info available.
#2  0x00005579afbb48cb in ?? ()
No symbol table info available.
#3  0x00005579afbb4a6d in ap_php_vsnprintf ()
No symbol table info available.
#4  0x00007fdf9b71a46b in xdebug_sprintf (fmt=fmt@entry=0x7fdf9b73bbd5 ":%s:%d-%d}")
    at /tmp/pear/temp/xdebug/src/lib/str.c:215
        n = <optimized out>
        new_str = 0x5579b24a2bc0 ":"
        size = 32
        args = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fff1e7b6e00, reg_save_area = 0x7fff1e7b6d20}}
#5  0x00007fdf9b718358 in xdebug_wrap_closure_location_around_function_name (opa=0x7fdf9b8667b8,
    fname=0x5579b23692e8 "newInstanceWithoutConstructor") at /tmp/pear/temp/xdebug/src/lib/lib.c:598
        tmp = {l = 28, a = 1052, d = 0x5579b24a2bf0 "newInstanceWithoutConstructo"}
        tmp_loc_info = <optimized out>
#6  0x00007fdf9b712dd1 in xdebug_build_fname (tmp=tmp@entry=0x5579b24a3e50, edata=edata@entry=0x7fdf9b81d130)
    at /tmp/pear/temp/xdebug/src/base/base.c:264
No locals.
#7  0x00007fdf9b713029 in xdebug_add_stack_frame (zdata=<optimized out>, zdata@entry=0x7fdf9b81d130,
    op_array=0x7fdf9b8667b8, type=type@entry=0) at /tmp/pear/temp/xdebug/src/base/base.c:637
        edata = 0x7fdf9b81d130
        opline_ptr = 0x7fdf9b81d130
        tmp = 0x5579b24a3e50
        cur_opcode = <optimized out>
#8  0x00007fdf9b713edb in xdebug_execute_internal (current_execute_data=0x7fdf9b81d130, return_value=0x7fdf9b81d110)
    at /tmp/pear/temp/xdebug/src/base/base.c:888
--Type <RET> for more, q to quit, c to continue without paging--c
        edata = <optimized out>
        fse = <optimized out>
        function_nr = 0
        function_call_traced = 0
        restore_error_handler_situation = 0
        tmp_error_cb = 0x0
#9  0x00005579afc95612 in execute_ex ()
No symbol table info available.
#10 0x00007fdf9b713801 in xdebug_execute_ex (execute_data=0x7fdf9b81d030) at /tmp/pear/temp/xdebug/src/base/base.c:801
        op_array = 0x7fdf9b890260
        edata = <optimized out>
        fse = 0x5579b24a3d90
        function_nr = 0
        code_coverage_function_name = 0x0
        code_coverage_filename = 0x0
        code_coverage_init = 0
#11 0x00005579afc976a2 in zend_execute ()
No symbol table info available.
#12 0x00005579afc113b3 in zend_execute_scripts ()
No symbol table info available.
#13 0x00005579afbb2548 in php_execute_script ()
No symbol table info available.
#14 0x00005579afc99bfe in ?? ()
No symbol table info available.
#15 0x00005579af866fdc in ?? ()
No symbol table info available.
#16 0x00007fdf9e82f09b in __libc_start_main (main=0x5579af866b50, argc=2, argv=0x7fff1e7baa08, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fff1e7ba9f8) at ../csu/libc-start.c:308
        self = <optimized out>
        result = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, -9047746716087511225, 93981124228752, 140733704808960, 0, 0, -2926617175082559673, -2944350448894372025}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x7fff1e7baa20, 0x7fdf9f471190}, data = {prev = 0x0, cleanup = 0x0, canceltype = 511420960}}}
        not_first_call = <optimized out>
#17 0x00005579af8676ba in _start ()
No symbol table info available.
gdb-trace.txt (4,707 bytes)   

derick

2020-11-27 16:58

administrator   ~0005552

https://github.com/xdebug/xdebug/pull/696

Fixed in GIT (master and xdebug_3_0) for xdebug 3.0.1

Issue History

Date Modified Username Field Change
2020-11-26 17:24 serbancatalin18 New Issue
2020-11-26 17:24 serbancatalin18 File Added: gdb-trace.txt
2020-11-26 19:54 derick Status new => confirmed
2020-11-26 19:54 derick Product Version => 3.0.0
2020-11-26 19:54 derick Target Version => 3.0dev
2020-11-26 19:54 derick Description Updated
2020-11-26 19:54 derick Steps to Reproduce Updated
2020-11-26 19:54 derick Additional Information Updated
2020-11-27 16:25 derick Summary Segmentation fault Closure::fromCallable Xdebug v3.0.0 => Segfault with closures that are not created from user code
2020-11-27 16:58 derick Assigned To => derick
2020-11-27 16:58 derick Status confirmed => closed
2020-11-27 16:58 derick Resolution open => fixed
2020-11-27 16:58 derick Fixed in Version => 3.0.1
2020-11-27 16:58 derick Note Added: 0005552