0001545: Script using notice-generating eval crashes with trap 6

ID	Project	Category	View Status	Date Submitted	Last Update
0001545	Xdebug	Step Debugging	public	2018-04-16 23:45	2018-08-01 18:55

Reporter	dwilks	Assigned To
Priority	normal	Severity	crash	Reproducibility	always
Status	resolved	Resolution	fixed
Platform	Apple	OS	MacOS High Sierra	OS Version	10.13.2
Product Version	2.6.0
Fixed in Version	2.6.1

Summary	0001545: Script using notice-generating eval crashes with trap 6
Description	Not sure if this is unique to the MacPorts build or a general issue in xdebug so i decided to start here... A simple script using eval() crashes PHP when xdebug 2.6 is loaded both from the command line (-R) or through an Apache request if the eval causes a Notice to be generated. My PHP 5.6 w/ xdebug 2.5.5 also works fine. I have a CentOS environment with php 7.0.20 w/ xdebug 2.5.5 and a 7.1.8 w/o xdebug and neither exhibit this issue.
Steps To Reproduce	$ php71 --version PHP 7.1.16 (cli) (built: Apr 2 2018 22:57:16) ( NTS ) Copyright (c) 1997-2018 The PHP Group Zend Engine v3.1.0, Copyright (c) 1998-2018 Zend Technologies with Xdebug v2.6.0, Copyright (c) 2002-2018, by Derick Rethans $ php71 -r 'error_reporting(E_ALL); $t = "\$arr[0] .= \"abc\";"; echo "$t\n"; eval($t); echo "Done\n";' $arr[0] .= "abc"; PHP Notice: Undefined variable: arr in Command line code(1) : eval()'d code on line 1 PHP Stack trace: PHP 1. {main}() Command line code:0 PHP 2. {main}() Command line code:0 php71(38476,0x7fffb6ad6340) malloc: *error for object 0x1094dddbf: pointer being freed was not allocated* set a breakpoint in malloc_error_break to debug Abort trap: 6 Without the .= and associated Undefined variable notice $ php71 -r 'error_reporting(E_ALL); $t = "\$arr[0] = \"abc\";"; echo "$t\n"; eval($t); echo "Done\n";' $arr[0] = "abc"; Done $ php70 --version PHP 7.0.29 (cli) (built: Mar 30 2018 05:11:11) ( NTS ) Copyright (c) 1997-2017 The PHP Group Zend Engine v3.0.0, Copyright (c) 1998-2017 Zend Technologies with Zend OPcache v7.0.29, Copyright (c) 1999-2017, by Zend Technologies with Xdebug v2.6.0, Copyright (c) 2002-2018, by Derick Rethans $ php70 -r 'error_reporting(E_ALL); $t = "\$arr[0] .= \"abc\";"; echo "$t\n"; eval($t); echo "Done\n";' $arr[0] .= "abc"; PHP Notice: Undefined variable: arr in Command line code(1) : eval()'d code on line 1 PHP Stack trace: PHP 1. {main}() Command line code:0 PHP 2. {main}() Command line code:0 php70(38628,0x7fffb6ad6340) malloc: *error for object 0x101223dbf: pointer being freed was not allocated* set a breakpoint in malloc_error_break to debug Abort trap: 6 Again without the notice php70 -r 'error_reporting(E_ALL); $t = "\$arr[0] = \"abc\";"; echo "$t\n"; eval($t); echo "Done\n";' $arr[0] = "abc"; Done
Additional Information	phpinfo() PHP Version => 7.1.16 System => Darwin dwilks-mbp-l.intacct.com 17.3.0 Darwin Kernel Version 17.3.0: Thu Nov 9 18:09:22 PST 2017; root:xnu-4570.31.3~1/RELEASE_X86_64 x86_64 Build Date => Apr 2 2018 22:56:46 Configure Command => './configure' '--prefix=/opt/local' '--mandir=/opt/local/share/man' '--infodir=/opt/local/share/info' '--program-suffix=71' '--includedir=/opt/local/include/php71' '--libdir=/opt/local/lib/php71' '--with-config-file-path=/opt/local/etc/php71' '--with-config-file-scan-dir=/opt/local/var/db/php71' '--disable-all' '--enable-bcmath' '--enable-ctype' '--enable-dom' '--enable-filter' '--enable-hash' '--enable-json' '--enable-libxml' '--enable-pdo' '--enable-session' '--enable-simplexml' '--enable-tokenizer' '--enable-xml' '--enable-xmlreader' '--enable-xmlwriter' '--with-bz2=/opt/local' '--with-mhash=/opt/local' '--with-pcre-regex=/opt/local' '--with-libxml-dir=/opt/local' '--with-zlib=/opt/local' '--without-pear' '--disable-cgi' '--enable-cli' '--enable-fileinfo' '--enable-phar' '--disable-fpm' '--with-libedit=/opt/local' 'YACC=true' Server API => Command Line Interface Virtual Directory Support => disabled Configuration File (php.ini) Path => /opt/local/etc/php71 Loaded Configuration File => /opt/local/etc/php71/php.ini Scan this dir for additional .ini files => /opt/local/var/db/php71 Additional .ini files parsed => /opt/local/var/db/php71/xdebug.ini PHP API => 20160303 PHP Extension => 20160303 Zend Extension => 320160303 Zend Extension Build => API320160303,NTS PHP Extension Build => API20160303,NTS Debug Build => no Thread Safety => disabled Zend Signal Handling => enabled Zend Memory Manager => enabled Zend Multibyte Support => disabled IPv6 Support => enabled DTrace Support => disabled Registered PHP Streams => compress.zlib, compress.bzip2, php, file, glob, data, http, ftp, phar Registered Stream Socket Transports => tcp, udp, unix, udg Registered Stream Filters => zlib., bzip2., string.rot13, string.toupper, string.tolower, string.strip_tags, convert., consumed, dechunk This program makes use of the Zend Scripting Language Engine: Zend Engine v3.1.0, Copyright (c) 1998-2018 Zend Technologies with Xdebug v2.6.0, Copyright (c) 2002-2018, by Derick Rethans Configuration bcmath BCMath support => enabled Directive => Local Value => Master Value bcmath.scale => 0 => 0 bz2 BZip2 Support => Enabled Stream Wrapper support => compress.bzip2:// Stream Filter support => bzip2.decompress, bzip2.compress BZip2 Version => 1.0.6, 6-Sept-2010 Core PHP Version => 7.1.16 Directive => Local Value => Master Value allow_url_fopen => On => On allow_url_include => On => On arg_separator.input => & => & arg_separator.output => & => & auto_append_file => no value => no value auto_globals_jit => On => On auto_prepend_file => /opt/local/etc/php54/def.inc => /opt/local/etc/php54/def.inc browscap => no value => no value default_charset => UTF-8 => UTF-8 default_mimetype => text/html => text/html disable_classes => no value => no value disable_functions => no value => no value display_errors => Off => Off display_startup_errors => Off => Off doc_root => no value => no value docref_ext => no value => no value docref_root => no value => no value enable_dl => On => On enable_post_data_reading => On => On error_append_string => no value => no value error_log => /tmp/error_php.log => /tmp/error_php.log error_prepend_string => no value => no value error_reporting => 22517 => 22517 expose_php => Off => Off extension_dir => /opt/local/lib/php71/extensions/no-debug-non-zts-20160303 => /opt/local/lib/php71/extensions/no-debug-non-zts-20160303 file_uploads => On => On hard_timeout => 2 => 2 highlight.comment => <font style="color: #FF8000">#FF8000</font> => <font style="color: #FF8000">#FF8000</font> highlight.default => <font style="color: #0000BB">#0000BB</font> => <font style="color: #0000BB">#0000BB</font> highlight.html => <font style="color: #000000">#000000</font> => <font style="color: #000000">#000000</font> highlight.keyword => <font style="color: #007700">#007700</font> => <font style="color: #007700">#007700</font> highlight.string => <font style="color: #DD0000">#DD0000</font> => <font style="color: #DD0000">#DD0000</font> html_errors => Off => Off ignore_repeated_errors => Off => Off ignore_repeated_source => Off => Off ignore_user_abort => Off => Off implicit_flush => On => On include_path => .:/opt/local/lib/php54 => .:/opt/local/lib/php54 input_encoding => no value => no value internal_encoding => no value => no value log_errors => On => On log_errors_max_len => 1024 => 1024 mail.add_x_header => On => On mail.force_extra_parameters => no value => no value mail.log => no value => no value max_execution_time => 0 => 0 max_file_uploads => 40 => 40 max_input_nesting_level => 64 => 64 max_input_time => -1 => -1 max_input_vars => 1000 => 1000 memory_limit => 1768M => 1768M open_basedir => no value => no value output_buffering => 0 => 0 output_encoding => no value => no value output_handler => no value => no value post_max_size => 400M => 400M precision => 14 => 14 realpath_cache_size => 4096K => 4096K realpath_cache_ttl => 120 => 120 register_argc_argv => On => On report_memleaks => On => On report_zend_debug => Off => Off request_order => GP => GP sendmail_from => no value => no value sendmail_path => /usr/sbin/sendmail -t -i => /usr/sbin/sendmail -t -i serialize_precision => 100 => 100 short_open_tag => On => On SMTP => localhost => localhost smtp_port => 25 => 25 sql.safe_mode => Off => Off sys_temp_dir => no value => no value track_errors => Off => Off unserialize_callback_func => no value => no value upload_max_filesize => 300M => 300M upload_tmp_dir => no value => no value user_dir => no value => no value user_ini.cache_ttl => 300 => 300 user_ini.filename => .user.ini => .user.ini variables_order => GPCS => GPCS xmlrpc_error_number => 0 => 0 xmlrpc_errors => Off => Off zend.assertions => 1 => 1 zend.detect_unicode => On => On zend.enable_gc => Off => Off zend.multibyte => Off => Off zend.script_encoding => no value => no value zend.signal_check => Off => Off ctype ctype functions => enabled date date/time support => enabled timelib version => 2016.05 "Olson" Timezone Database Version => 2018.3 Timezone Database => internal Default timezone => America/Los_Angeles Directive => Local Value => Master Value date.default_latitude => 31.7667 => 31.7667 date.default_longitude => 35.2333 => 35.2333 date.sunrise_zenith => 90.583333 => 90.583333 date.sunset_zenith => 90.583333 => 90.583333 date.timezone => America/Los_Angeles => America/Los_Angeles dom DOM/XML => enabled DOM/XML API Version => 20031129 libxml Version => 2.9.7 HTML Support => enabled XPath Support => enabled XPointer Support => enabled Schema Support => enabled RelaxNG Support => enabled fileinfo fileinfo support => enabled version => 1.0.5 libmagic => 522 filter Input Validation and Filtering => enabled Revision => $Id: a4ca1e0a99c260cb8a4cf5d7369d130f7b934185 $ Directive => Local Value => Master Value filter.default => unsafe_raw => unsafe_raw filter.default_flags => no value => no value hash hash support => enabled Hashing Engines => md2 md4 md5 sha1 sha224 sha256 sha384 sha512/224 sha512/256 sha512 sha3-224 sha3-256 sha3-384 sha3-512 ripemd128 ripemd160 ripemd256 ripemd320 whirlpool tiger128,3 tiger160,3 tiger192,3 tiger128,4 tiger160,4 tiger192,4 snefru snefru256 gost gost-crypto adler32 crc32 crc32b fnv132 fnv1a32 fnv164 fnv1a64 joaat haval128,3 haval160,3 haval192,3 haval224,3 haval256,3 haval128,4 haval160,4 haval192,4 haval224,4 haval256,4 haval128,5 haval160,5 haval192,5 haval224,5 haval256,5 MHASH support => Enabled MHASH API Version => Emulated Support json json support => enabled json version => 1.5.0 libxml libXML support => active libXML Compiled Version => 2.9.7 libXML Loaded Version => 20907 libXML streams => enabled mysqlnd mysqlnd => enabled Version => mysqlnd 5.0.12-dev - 20150407 - $Id: 38fea24f2847fa7519001be390c98ae0acafe387 $ Compression => supported core SSL => supported extended SSL => not supported Command buffer size => 4096 Read buffer size => 32768 Read timeout => 31536000 Collecting statistics => Yes Collecting memory statistics => Yes Tracing => n/a Loaded plugins => mysqlnd,debug_trace,auth_plugin_mysql_native_password,auth_plugin_mysql_clear_password API Extensions => mysqlnd statistics => bytes_sent => 0 bytes_received => 0 packets_sent => 0 packets_received => 0 protocol_overhead_in => 0 protocol_overhead_out => 0 bytes_received_ok_packet => 0 bytes_received_eof_packet => 0 bytes_received_rset_header_packet => 0 bytes_received_rset_field_meta_packet => 0 bytes_received_rset_row_packet => 0 bytes_received_prepare_response_packet => 0 bytes_received_change_user_packet => 0 packets_sent_command => 0 packets_received_ok => 0 packets_received_eof => 0 packets_received_rset_header => 0 packets_received_rset_field_meta => 0 packets_received_rset_row => 0 packets_received_prepare_response => 0 packets_received_change_user => 0 result_set_queries => 0 non_result_set_queries => 0 no_index_used => 0 bad_index_used => 0 slow_queries => 0 buffered_sets => 0 unbuffered_sets => 0 ps_buffered_sets => 0 ps_unbuffered_sets => 0 flushed_normal_sets => 0 flushed_ps_sets => 0 ps_prepared_never_executed => 0 ps_prepared_once_executed => 0 rows_fetched_from_server_normal => 0 rows_fetched_from_server_ps => 0 rows_buffered_from_client_normal => 0 rows_buffered_from_client_ps => 0 rows_fetched_from_client_normal_buffered => 0 rows_fetched_from_client_normal_unbuffered => 0 rows_fetched_from_client_ps_buffered => 0 rows_fetched_from_client_ps_unbuffered => 0 rows_fetched_from_client_ps_cursor => 0 rows_affected_normal => 0 rows_affected_ps => 0 rows_skipped_normal => 0 rows_skipped_ps => 0 copy_on_write_saved => 0 copy_on_write_performed => 0 command_buffer_too_small => 0 connect_success => 0 connect_failure => 0 connection_reused => 0 reconnect => 0 pconnect_success => 0 active_connections => 0 active_persistent_connections => 0 explicit_close => 0 implicit_close => 0 disconnect_close => 0 in_middle_of_command_close => 0 explicit_free_result => 0 implicit_free_result => 0 explicit_stmt_close => 0 implicit_stmt_close => 0 mem_emalloc_count => 0 mem_emalloc_amount => 0 mem_ecalloc_count => 0 mem_ecalloc_amount => 0 mem_erealloc_count => 0 mem_erealloc_amount => 0 mem_efree_count => 0 mem_efree_amount => 0 mem_malloc_count => 0 mem_malloc_amount => 0 mem_calloc_count => 0 mem_calloc_amount => 0 mem_realloc_count => 0 mem_realloc_amount => 0 mem_free_count => 0 mem_free_amount => 0 mem_estrndup_count => 0 mem_strndup_count => 0 mem_estrdup_count => 0 mem_strdup_count => 0 mem_edupl_count => 0 mem_dupl_count => 0 proto_text_fetched_null => 0 proto_text_fetched_bit => 0 proto_text_fetched_tinyint => 0 proto_text_fetched_short => 0 proto_text_fetched_int24 => 0 proto_text_fetched_int => 0 proto_text_fetched_bigint => 0 proto_text_fetched_decimal => 0 proto_text_fetched_float => 0 proto_text_fetched_double => 0 proto_text_fetched_date => 0 proto_text_fetched_year => 0 proto_text_fetched_time => 0 proto_text_fetched_datetime => 0 proto_text_fetched_timestamp => 0 proto_text_fetched_string => 0 proto_text_fetched_blob => 0 proto_text_fetched_enum => 0 proto_text_fetched_set => 0 proto_text_fetched_geometry => 0 proto_text_fetched_other => 0 proto_binary_fetched_null => 0 proto_binary_fetched_bit => 0 proto_binary_fetched_tinyint => 0 proto_binary_fetched_short => 0 proto_binary_fetched_int24 => 0 proto_binary_fetched_int => 0 proto_binary_fetched_bigint => 0 proto_binary_fetched_decimal => 0 proto_binary_fetched_float => 0 proto_binary_fetched_double => 0 proto_binary_fetched_date => 0 proto_binary_fetched_year => 0 proto_binary_fetched_time => 0 proto_binary_fetched_datetime => 0 proto_binary_fetched_timestamp => 0 proto_binary_fetched_string => 0 proto_binary_fetched_json => 0 proto_binary_fetched_blob => 0 proto_binary_fetched_enum => 0 proto_binary_fetched_set => 0 proto_binary_fetched_geometry => 0 proto_binary_fetched_other => 0 init_command_executed_count => 0 init_command_failed_count => 0 com_quit => 0 com_init_db => 0 com_query => 0 com_field_list => 0 com_create_db => 0 com_drop_db => 0 com_refresh => 0 com_shutdown => 0 com_statistics => 0 com_process_info => 0 com_connect => 0 com_process_kill => 0 com_debug => 0 com_ping => 0 com_time => 0 com_delayed_insert => 0 com_change_user => 0 com_binlog_dump => 0 com_table_dump => 0 com_connect_out => 0 com_register_slave => 0 com_stmt_prepare => 0 com_stmt_execute => 0 com_stmt_send_long_data => 0 com_stmt_close => 0 com_stmt_reset => 0 com_stmt_set_option => 0 com_stmt_fetch => 0 com_deamon => 0 bytes_received_real_data_normal => 0 bytes_received_real_data_ps => 0 pcre PCRE (Perl Compatible Regular Expressions) Support => enabled PCRE Library Version => 8.41 2017-07-05 PCRE JIT Support => enabled Directive => Local Value => Master Value pcre.backtrack_limit => 1000000 => 1000000 pcre.jit => 1 => 1 pcre.recursion_limit => 100000 => 100000 PDO PDO support => enabled PDO drivers => Phar Phar: PHP Archive support => enabled Phar EXT version => 2.0.2 Phar API version => 1.1.1 SVN revision => $Id: 898d1dac303a2eedebae7b6c8fa859253b781100 $ Phar-based phar archives => enabled Tar-based phar archives => enabled ZIP-based phar archives => enabled gzip compression => enabled bzip2 compression => enabled OpenSSL support => disabled (install ext/openssl) Phar based on pear/PHP_Archive, original concept by Davey Shafik. Phar fully realized by Gregory Beaver and Marcus Boerger. Portions of tar implementation Copyright (c) 2003-2009 Tim Kientzle. Directive => Local Value => Master Value phar.cache_list => no value => no value phar.readonly => On => On phar.require_hash => On => On readline Readline Support => enabled Readline library => EditLine wrapper Directive => Local Value => Master Value cli.pager => no value => no value cli.prompt => \b > => \b > Reflection Reflection => enabled Version => $Id: 7c6e20c07e8435a5148263b349668853c0057575 $ session Session Support => enabled Registered save handlers => files user Registered serializer handlers => php_serialize php php_binary Directive => Local Value => Master Value session.auto_start => Off => Off session.cache_expire => 180 => 180 session.cache_limiter => nocache => nocache session.cookie_domain => no value => no value session.cookie_httponly => Off => Off session.cookie_lifetime => 0 => 0 session.cookie_path => / => / session.cookie_secure => Off => Off session.gc_divisor => 1000 => 1000 session.gc_maxlifetime => 1440 => 1440 session.gc_probability => 1 => 1 session.lazy_write => On => On session.name => PHPSESSID => PHPSESSID session.referer_check => no value => no value session.save_handler => files => files session.save_path => no value => no value session.serialize_handler => php => php session.sid_bits_per_character => 4 => 4 session.sid_length => 32 => 32 session.upload_progress.cleanup => On => On session.upload_progress.enabled => On => On session.upload_progress.freq => 1% => 1% session.upload_progress.min_freq => 1 => 1 session.upload_progress.name => PHP_SESSION_UPLOAD_PROGRESS => PHP_SESSION_UPLOAD_PROGRESS session.upload_progress.prefix => uploadprogress => uploadprogress session.use_cookies => On => On session.use_only_cookies => On => On session.use_strict_mode => Off => Off session.use_trans_sid => 0 => 0 SimpleXML Simplexml support => enabled Revision => $Id: ae067cdcddf424d6e762603905b98798bc924a00 $ Schema support => enabled SPL SPL support => enabled Interfaces => Countable, OuterIterator, RecursiveIterator, SeekableIterator, SplObserver, SplSubject Classes => AppendIterator, ArrayIterator, ArrayObject, BadFunctionCallException, BadMethodCallException, CachingIterator, CallbackFilterIterator, DirectoryIterator, DomainException, EmptyIterator, FilesystemIterator, FilterIterator, GlobIterator, InfiniteIterator, InvalidArgumentException, IteratorIterator, LengthException, LimitIterator, LogicException, MultipleIterator, NoRewindIterator, OutOfBoundsException, OutOfRangeException, OverflowException, ParentIterator, RangeException, RecursiveArrayIterator, RecursiveCachingIterator, RecursiveCallbackFilterIterator, RecursiveDirectoryIterator, RecursiveFilterIterator, RecursiveIteratorIterator, RecursiveRegexIterator, RecursiveTreeIterator, RegexIterator, RuntimeException, SplDoublyLinkedList, SplFileInfo, SplFileObject, SplFixedArray, SplHeap, SplMinHeap, SplMaxHeap, SplObjectStorage, SplPriorityQueue, SplQueue, SplStack, SplTempFileObject, UnderflowException, UnexpectedValueException standard Dynamic Library Support => enabled Path to sendmail => /usr/sbin/sendmail -t -i Directive => Local Value => Master Value assert.active => 1 => 1 assert.bail => 0 => 0 assert.callback => no value => no value assert.exception => 0 => 0 assert.quiet_eval => 0 => 0 assert.warning => 1 => 1 auto_detect_line_endings => 0 => 0 default_socket_timeout => 60 => 60 from => no value => no value session.trans_sid_hosts => no value => no value session.trans_sid_tags => a=href,area=href,frame=src,form= => a=href,area=href,frame=src,form= url_rewriter.hosts => no value => no value url_rewriter.tags => a=href,area=href,frame=src,input=src,form=fakeentry => a=href,area=href,frame=src,input=src,form=fakeentry user_agent => no value => no value tokenizer Tokenizer Support => enabled xdebug xdebug support => enabled Version => 2.6.0 IDE Key => default Supported protocols DBGp - Common DeBuGger Protocol Directive => Local Value => Master Value xdebug.auto_trace => Off => Off xdebug.cli_color => 0 => 0 xdebug.collect_assignments => Off => Off xdebug.collect_includes => On => On xdebug.collect_params => 0 => 0 xdebug.collect_return => Off => Off xdebug.collect_vars => Off => Off xdebug.coverage_enable => On => On xdebug.default_enable => On => On xdebug.dump.COOKIE => no value => no value xdebug.dump.ENV => no value => no value xdebug.dump.FILES => no value => no value xdebug.dump.GET => no value => no value xdebug.dump.POST => no value => no value xdebug.dump.REQUEST => no value => no value xdebug.dump.SERVER => no value => no value xdebug.dump.SESSION => no value => no value xdebug.dump_globals => On => On xdebug.dump_once => On => On xdebug.dump_undefined => Off => Off xdebug.extended_info => On => On xdebug.file_link_format => no value => no value xdebug.filename_format => no value => no value xdebug.force_display_errors => Off => Off xdebug.force_error_reporting => 0 => 0 xdebug.gc_stats_enable => Off => Off xdebug.gc_stats_output_dir => /var/tmp/ => /var/tmp/ xdebug.gc_stats_output_name => gcstats.%p => gcstats.%p xdebug.halt_level => 0 => 0 xdebug.idekey => default => default xdebug.max_nesting_level => 256 => 256 xdebug.max_stack_frames => -1 => -1 xdebug.overload_var_dump => 2 => 2 xdebug.profiler_aggregate => Off => Off xdebug.profiler_append => Off => Off xdebug.profiler_enable => Off => Off xdebug.profiler_enable_trigger => On => On xdebug.profiler_enable_trigger_value => no value => no value xdebug.profiler_output_dir => /tmp => /tmp xdebug.profiler_output_name => callgrind.out.%p.%r => callgrind.out.%p.%r xdebug.remote_addr_header => no value => no value xdebug.remote_autostart => On => On xdebug.remote_connect_back => Off => Off xdebug.remote_cookie_expire_time => 157680000 => 157680000 xdebug.remote_enable => On => On xdebug.remote_handler => dbgp => dbgp xdebug.remote_host => 127.0.0.1 => 127.0.0.1 xdebug.remote_log => no value => no value xdebug.remote_mode => req => req xdebug.remote_port => 9000 => 9000 xdebug.remote_timeout => 200 => 200 xdebug.scream => Off => Off xdebug.show_error_trace => Off => Off xdebug.show_exception_trace => Off => Off xdebug.show_local_vars => On => On xdebug.show_mem_delta => Off => Off xdebug.trace_enable_trigger => Off => Off xdebug.trace_enable_trigger_value => no value => no value xdebug.trace_format => 0 => 0 xdebug.trace_options => 0 => 0 xdebug.trace_output_dir => /var/tmp/ => /var/tmp/ xdebug.trace_output_name => trace.%c => trace.%c xdebug.var_display_max_children => 128 => 128 xdebug.var_display_max_data => 512 => 512 xdebug.var_display_max_depth => 3 => 3 xml XML Support => active XML Namespace Support => active libxml2 Version => 2.9.7 xmlreader XMLReader => enabled xmlwriter XMLWriter => enabled zlib ZLib Support => enabled Stream Wrapper => compress.zlib:// Stream Filter => zlib.inflate, zlib.deflate Compiled Version => 1.2.11 Linked Version => 1.2.11 Directive => Local Value => Master Value zlib.output_compression => Off => Off zlib.output_compression_level => -1 => -1 zlib.output_handler => no value => no value Additional Modules Module Name Environment Variable => Value MANPATH => /opt/local/share/man:/Users/dwilks/.nvm/versions/node/v9.5.0/share/man:/usr/local/share/man:/usr/share/man:/opt/X11/share/man:/Applications/Xcode.app/Contents/Developer/usr/share/man:/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/share/man TERM_PROGRAM => Apple_Terminal NVM_CD_FLAGS => SHELL => /bin/bash TERM => xterm-256color TMPDIR => /var/folders/07/2zxhp_b96pv7j5gqcr_lx9540wbzp2/T/ NVM_PATH => /Users/dwilks/.nvm/versions/node/v9.5.0/lib/node GRADLE_HOME => /usr/local/gradle/current Apple_PubSub_Socket_Render => /private/tmp/com.apple.launchd.qwTo9gQ59o/Render CVSROOT => :pserver:dwilks@cvs.intacct.com:/cvsroot TERM_PROGRAM_VERSION => 400 TERM_SESSION_ID => 4E1662D4-9301-4B44-8135-7C2B31B081A2 NVM_DIR => /Users/dwilks/.nvm USER => dwilks SSH_AUTH_SOCK => /private/tmp/com.apple.launchd.HjEW2g68WX/Listeners TNS_ADMIN => /usr/local/intacct/etc/ PATH => /opt/local/bin:/opt/local/sbin:/Users/dwilks/bin:/Users/dwilks/sqlplus:/opt/local/bin:/Users/dwilks/.nvm/versions/node/v9.5.0/bin:/usr/local/heroku/bin:/usr/local/gradle/current/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/X11/bin:/Applications/Wireshark.app/Contents/MacOS NVM_NODEJS_ORG_MIRROR => https://nodejs.org/dist PWD => /Users/dwilks IA_EXTERNALS => ../externals/ LANG => en_US.UTF-8 XPC_FLAGS => 0x0 XPC_SERVICE_NAME => 0 SHLVL => 1 HOME => /Users/dwilks LOGNAME => dwilks NVM_BIN => /Users/dwilks/.nvm/versions/node/v9.5.0/bin NVM_IOJS_ORGMIRROR => https://iojs.org/dist DISPLAY => /private/tmp/com.apple.launchd.u910hobMT3/org.macosforge.xquartz:0 => /opt/local/bin/php PHP Variables Variable => Value $_SERVER['MANPATH'] => /opt/local/share/man:/Users/dwilks/.nvm/versions/node/v9.5.0/share/man:/usr/local/share/man:/usr/share/man:/opt/X11/share/man:/Applications/Xcode.app/Contents/Developer/usr/share/man:/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/share/man $_SERVER['TERM_PROGRAM'] => Apple_Terminal $_SERVER['NVM_CD_FLAGS'] => $_SERVER['SHELL'] => /bin/bash $_SERVER['TERM'] => xterm-256color $_SERVER['TMPDIR'] => /var/folders/07/2zxhp_b96pv7j5gqcr_lx9540wbzp2/T/ $_SERVER['NVM_PATH'] => /Users/dwilks/.nvm/versions/node/v9.5.0/lib/node $_SERVER['GRADLE_HOME'] => /usr/local/gradle/current $_SERVER['Apple_PubSub_Socket_Render'] => /private/tmp/com.apple.launchd.qwTo9gQ59o/Render $_SERVER['CVSROOT'] => :pserver:dwilks@cvs.intacct.com:/cvsroot $_SERVER['TERM_PROGRAM_VERSION'] => 400 $_SERVER['TERM_SESSION_ID'] => 4E1662D4-9301-4B44-8135-7C2B31B081A2 $_SERVER['NVM_DIR'] => /Users/dwilks/.nvm $_SERVER['USER'] => dwilks $_SERVER['SSH_AUTH_SOCK'] => /private/tmp/com.apple.launchd.HjEW2g68WX/Listeners $_SERVER['TNS_ADMIN'] => /usr/local/intacct/etc/ $_SERVER['PATH'] => /opt/local/bin:/opt/local/sbin:/Users/dwilks/bin:/Users/dwilks/sqlplus:/opt/local/bin:/Users/dwilks/.nvm/versions/node/v9.5.0/bin:/usr/local/heroku/bin:/usr/local/gradle/current/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/X11/bin:/Applications/Wireshark.app/Contents/MacOS $_SERVER['NVM_NODEJS_ORG_MIRROR'] => https://nodejs.org/dist $_SERVER['PWD'] => /Users/dwilks $_SERVER['IA_EXTERNALS'] => ../externals/ $_SERVER['LANG'] => en_US.UTF-8 $_SERVER['XPC_FLAGS'] => 0x0 $_SERVER['XPC_SERVICE_NAME'] => 0 $_SERVER['SHLVL'] => 1 $_SERVER['HOME'] => /Users/dwilks $_SERVER['LOGNAME'] => dwilks $_SERVER['NVM_BIN'] => /Users/dwilks/.nvm/versions/node/v9.5.0/bin $_SERVER['NVM_IOJS_ORG_MIRROR'] => https://iojs.org/dist $_SERVER['DISPLAY'] => /private/tmp/com.apple.launchd.u910hobMT3/org.macosforge.xquartz:0 $SERVER['*'] => /opt/local/bin/php $_SERVER['PHP_SELF'] => $_SERVER['SCRIPT_NAME'] => $_SERVER['SCRIPT_FILENAME'] => $_SERVER['PATH_TRANSLATED'] => $_SERVER['DOCUMENT_ROOT'] => $_SERVER['REQUEST_TIME_FLOAT'] => 1523920395.8103 $_SERVER['REQUEST_TIME'] => 1523920395 $_SERVER['argv'] => Array ( ) $_SERVER['argc'] => 0 PHP License This program is free software; you can redistribute it and/or modify it under the terms of the PHP License as published by the PHP Group and included in the distribution in the file: LICENSE This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. If you did not receive a copy of the PHP license, or have any questions about PHP licensing, please contact license@php.net.
Tags	No tags attached.

Operating System
PHP Version	7.1.15-7.1.19

derick 2018-04-17 08:45 administrator ~0004636	I can't reproduce this on Linux: [PHP: 7.1.15-dev ] derick@singlemalt:~ $ php -v PHP 7.1.15-dev (cli) (built: Feb 9 2018 13:45:03) ( NTS DEBUG ) Copyright (c) 1997-2018 The PHP Group Zend Engine v3.1.0, Copyright (c) 1998-2018 Zend Technologies with Zend OPcache v7.1.15-dev, Copyright (c) 1999-2018, by Zend Technologies with Xdebug v2.6.0, Copyright (c) 2002-2018, by Derick Rethans [PHP: 7.1.15-dev ] derick@singlemalt:~ $ php -r 'error_reporting(E_ALL); $t = "\$arr[0] .= \"abc\";"; echo "$t\n"; eval($t); echo "Done\n";' $arr[0] .= "abc"; Notice: Undefined variable: arr in Command line code(1) : eval()'d code on line 1 Call Stack: 0.0005 383296 1. {main}() Command line code:0 0.0007 385376 2. {main}() Command line code:0 Notice: Undefined offset: 0 in Command line code(1) : eval()'d code on line 1 Call Stack: 0.0005 383296 1. {main}() Command line code:0 0.0007 385376 2. {main}() Command line code:0 Done Can you attach the output of "php --ri Xdebug" in a file? If you want, you can also try to make a backtrace. For that you need GDB installed, and then you can run: gdb --args php -r 'error_reporting(E_ALL); $t = "\$arr[0] .= \"abc\";"; echo "$t\n"; eval($t); echo "Done\n";' (Using your correct php71/php70 binary, of course).

dwilks 2018-04-17 19:18 reporter ~0004637	thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1 frame #0: 0x00007fff7dc299b6 libsystem_malloc.dylib`malloc_error_break frame #1: 0x00007fff7dc1b7ed libsystem_malloc.dylib`free + 400 frame 0000002: 0x0000000105a1ffb8 xdebug.so`xdebug_xml_attribute_dtor + 37 frame #3: 0x0000000105a1ff69 xdebug.so`xdebug_xml_node_dtor + 51 frame 0000004: 0x0000000105a1ff5b xdebug.so`xdebug_xml_node_dtor + 37 frame #5: 0x0000000105a0b64d xdebug.so`xdebug_dbgp_notification + 526 frame 0000006: 0x0000000105a15bfb xdebug.so`xdebug_error_cb + 1056 frame #7: 0x00000001001b97a0 php71`zend_error_va_list + 601 frame 0000008: 0x00000001001b9529 php71`zend_error + 124 frame #9: 0x0000000100244cfb php71`zend_binary_assign_op_dim_helper_SPEC_CV_CONST + 676 frame 0000010: 0x00000001002020a4 php71`ZEND_ASSIGN_CONCAT_SPEC_CV_CONST_DIM_HANDLER + 22 frame #11: 0x00000001001f5858 php71`execute_ex + 56 frame 0000012: 0x0000000105a0421f xdebug.so`xdebug_execute_ex + 2350 frame #13: 0x000000010020e9f2 php71`ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER + 760 frame 0000014: 0x00000001001f5858 php71`execute_ex + 56 frame #15: 0x0000000105a0421f xdebug.so`xdebug_execute_ex + 2350 frame 0000016: 0x00000001001f5ab6 php71`zend_execute + 537 frame #17: 0x00000001001ac76c php71`zend_eval_stringl + 444 frame 0000018: 0x00000001001ac853 php71`zend_eval_stringl_ex + 14 frame #19: 0x000000010024f78e php71`do_cli + 2945 frame 0000020: 0x000000010024ea87 php71`main + 1149 frame #21: 0x00007fff7da72115 libdyld.dylib`start + 1 frame 0000022: 0x00007fff7da72115 libdyld.dylib`start + 1

dwilks 2018-04-17 21:31 reporter ~0004638	Ok, I just pulled php 7.1.16 and xdebug 2.6.0 and built from sources and can't repro either. Looks like a macports build issue. I'll submit a case there and reference this. Thanks

dwilks 2018-04-17 22:19 reporter ~0004639	Reported to MacPorts team https://trac.macports.org/ticket/56317

dwilks 2018-04-18 20:11 reporter ~0004640 Last edited: 2018-04-18 20:12	I've reproduced this in a minimal php 7.1 build on Linux. $ ~/php71/bin/php -r 'error_reporting(E_ALL); $t = "\$arr[0] .= \"abc\";"; echo "$t\n"; eval($t); echo "Done\n";' $arr[0] .= "abc"; Notice: Undefined variable: arr in Command line code(1) : eval()'d code on line 1 Call Stack: 0.0115 378928 1. {main}() Command line code:0 0.0117 380592 2. {main}() Command line code:0 Segmentation fault What's needed: php.ini [xdebug] xdebug.remote_enable=1 xdebug.remote_autostart=1 A PhpStorm project open and primed to accept incoming debugger connections (telephone icon enabled). Note: PhpStorm doesn't need to debug the script. I have no idea if other debuggers would exhibit the same behavior. [dwilks@dev01 xdebug-2.6.0]$ gdb --args ~/php71/bin/php -r 'error_reporting(E_ALL); $t = "\$arr[0] .= \"abc\";"; echo "$t\n"; eval($t); echo "Done\n";' GNU gdb (GDB) Red Hat Enterprise Linux (7.2-92.el6) Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: http://www.gnu.org/software/gdb/bugs/... Reading symbols from /u02/home/dwilks/php71/bin/php...done. (gdb) run Starting program: /u02/home/dwilks/php71/bin/php -r error_reporting(E_ALL)\;\ \$t\ =\ \"\\$arr[0]\ .=\ \\"abc\\"\;\"\;\ echo\ \"\$t\n\"\;\ eval(\$t)\;\ echo\ \"Done\n\"\; [Thread debugging using libthread_db enabled] $arr[0] .= "abc"; Notice: Undefined variable: arr in Command line code(1) : eval()'d code on line 1 Call Stack: 0.0206 379120 1. {main}() Command line code:0 0.0207 380784 2. {main}() Command line code:0 Program received signal SIGSEGV, Segmentation fault. 0x00007ffff68608ec in free () from /lib64/libc.so.6 Missing separate debuginfos, use: debuginfo-install glibc-2.12-1.209.el6_9.2.x86_64 libxml2-2.7.6-21.el6_8.1.x86_64 nss-softokn-freebl-3.14.3-23.3.el6_8.x86_64 zlib-1.2.3-29.el6.x86_64 (gdb) bt #0 0x00007ffff68608ec in free () from /lib64/libc.so.6 #1 0x00007fffeff53ac6 in xdebug_xml_attribute_dtor (attr=0x11161c0) at /u02/home/dwilks/src/xdebug-2.6.0/xdebug_xml.c:188 0000002 0x00007fffeff53b52 in xdebug_xml_node_dtor (xml=0x11121a0) at /u02/home/dwilks/src/xdebug-2.6.0/xdebug_xml.c:205 0000003 0x00007fffeff53b35 in xdebug_xml_node_dtor (xml=0x1116680) at /u02/home/dwilks/src/xdebug-2.6.0/xdebug_xml.c:202 0000004 0x00007fffeff3bd91 in xdebug_dbgp_notification (context=0x7ffff016aaa8, file=0x7ffff60589d8 "Command line code(1) : eval()'d code", lineno=1, type=8, type_string=0x1116110 "Notice", message=0x7ffff60632a0 "Undefined variable: arr") at /u02/home/dwilks/src/xdebug-2.6.0/xdebug_handler_dbgp.c:2494 0000005 0x00007fffeff41e70 in xdebug_error_cb (type=8, error_filename=0x7ffff60589d8 "Command line code(1) : eval()'d code", error_lineno=1, format=0xc7a71f "Undefined variable: %s", args=0x7fffffffc3e0) at /u02/home/dwilks/src/xdebug-2.6.0/xdebug_stack.c:816 0000006 0x00000000007487cd in zend_error (type=8, format=0xc7a71f "Undefined variable: %s") at /u02/home/dwilks/src/php-src-PHP-7.1.16/Zend/zend.c:1192 0000007 0x00000000007a3140 in zval_undefined_cv (var=80, execute_data=0x7ffff60130d0) at /u02/home/dwilks/src/php-src-PHP-7.1.16/Zend/zend_execute.c:218 0000008 0x00000000007a324c in _get_zval_cv_lookup_BP_VAR_RW (ptr=0x7ffff6013120, var=80, execute_data=0x7ffff60130d0) at /u02/home/dwilks/src/php-src-PHP-7.1.16/Zend/zend_execute.c:257 0000009 0x0000000000803de6 in zend_binary_assign_op_dim_helper_SPEC_CV_CONST (binary_op=0x74050d <concat_function>, execute_data=0x7ffff60130d0) at /u02/home/dwilks/src/php-src-PHP-7.1.16/Zend/zend_vm_execute.h:37040 0000010 0x0000000000804670 in ZEND_ASSIGN_CONCAT_SPEC_CV_CONST_DIM_HANDLER (execute_data=0x7ffff60130d0) at /u02/home/dwilks/src/php-src-PHP-7.1.16/Zend/zend_vm_execute.h:37538 0000011 0x00000000007aeb70 in ZEND_USER_OPCODE_SPEC_HANDLER (execute_data=0x7ffff60130d0) at /u02/home/dwilks/src/php-src-PHP-7.1.16/Zend/zend_vm_execute.h:1822 0000012 0x00000000007aa83f in execute_ex (ex=0x7ffff60130d0) at /u02/home/dwilks/src/php-src-PHP-7.1.16/Zend/zend_vm_execute.h:432 0000013 0x00007fffeff22d2a in xdebug_execute_ex (execute_data=0x7ffff60130d0) at /u02/home/dwilks/src/xdebug-2.6.0/xdebug.c:1912 0000014 0x00000000007fec05 in ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER (execute_data=0x7ffff6013030) at /u02/home/dwilks/src/php-src-PHP-7.1.16/Zend/zend_vm_execute.h:35530 0000015 0x00000000007aeb70 in ZEND_USER_OPCODE_SPEC_HANDLER (execute_data=0x7ffff6013030) at /u02/home/dwilks/src/php-src-PHP-7.1.16/Zend/zend_vm_execute.h:1822 0000016 0x00000000007aa83f in execute_ex (ex=0x7ffff6013030) at /u02/home/dwilks/src/php-src-PHP-7.1.16/Zend/zend_vm_execute.h:432 0000017 0x00007fffeff22d2a in xdebug_execute_ex (execute_data=0x7ffff6013030) at /u02/home/dwilks/src/xdebug-2.6.0/xdebug.c:1912 0000018 0x00000000007aa990 in zend_execute (op_array=0x7ffff6086000, return_value=0x7fffffffcb20) at /u02/home/dwilks/src/php-src-PHP-7.1.16/Zend/zend_vm_execute.h:474 0000019 0x0000000000730a96 in zend_eval_stringl (str=0xfea010 "error_reporting(E_ALL); $t = \"\$arr[0] .= \\"abc\\";\"; echo \"$t\n\"; eval($t); echo \"Done\n\";", str_len=90, retval_ptr=0x0, string_name=0xc80364 "Command line code") at /u02/home/dwilks/src/php-src-PHP-7.1.16/Zend/zend_execute_API.c:1120 0000020 0x0000000000730c6b in zend_eval_stringl_ex ( str=0xfea010 "error_reporting(E_ALL); $t = \"\$arr[0] .= \\"abc\\";\"; echo \"$t\n\"; eval($t); echo \"Done\n\";", str_len=90, retval_ptr=0x0, string_name=0xc80364 "Command line code", handle_exceptions=1) at /u02/home/dwilks/src/php-src-PHP-7.1.16/Zend/zend_execute_API.c:1161 0000021 0x0000000000730cf7 in zend_eval_string_ex ( str=0xfea010 "error_reporting(E_ALL); $t = \"\$arr[0] .= \\"abc\\";\"; echo \"$t\n\"; eval($t); echo \"Done\n\";", retval_ptr=0x0, string_name=0xc80364 "Command line code", handle_exceptions=1) at /u02/home/dwilks/src/php-src-PHP-7.1.16/Zend/zend_execute_API.c:1172 0000022 0x000000000083e4bb in do_cli (argc=3, argv=0xfe9f90) at /u02/home/dwilks/src/php-src-PHP-7.1.16/sapi/cli/php_cli.c:1024 0000023 0x000000000083f2f5 in main (argc=3, argv=0xfe9f90) at /u02/home/dwilks/src/php-src-PHP-7.1.16/sapi/cli/php_cli.c:1381 (gdb) PHP ./configure --prefix=/u02/home/dwilks/php71 \ --enable-debug \ --with-config-file-path=/u02/home/dwilks/php71/etc \ --with-config-file-scan-dir=/u02/home/dwilks/php71/etc/conf.d \ --disable-all \ --enable-bcmath \ --enable-ctype \ --enable-dom \ --enable-filter \ --enable-hash \ --enable-json \ --enable-libxml \ --enable-pdo \ --enable-session \ --enable-simplexml \ --enable-tokenizer \ --enable-xml \ --enable-xmlreader \ --enable-xmlwriter \ --without-pear \ --disable-cgi \ --enable-cli \ --enable-fileinfo \ --enable-phar \ --disable-fpm xdebug /u02/home/dwilks/php71/bin/phpize ./configure --prefix=/u02/home/dwilks/php71 --with-php-config=/u02/home/dwilks/php71/bin/php-config make make install bash -c 'echo zend_extension=xdebug.so > /u02/home/dwilks/php71/etc/conf.d/xdebug.ini'

dwilks 2018-05-16 19:01 reporter ~0004654	Any luck reproducing this? I just ran into this trying to test our our app in php7.2. It took me a few minutes before I noticed the segfault in the apache error log and then traced it down to an eval().

dwilks 2018-05-17 00:17 reporter ~0004657	On the CentOS box I just noticed that this issue does NOT reproduce if PhpStorm 2017.3.4 is running and listening for the debug connection. It does reproduce with 2018.1.4 EAP 181.5087.11 (and earlier versions of 2018.1 - just not sure which ones). I had the same empty default project open listening for debug connections in both cases. This is for both PHP 7.1.16 and 7.2.4. Seems like something that PhpStorm is sending to xdebug that's causing it. I've attached the xdebug_log for both version. Seems like it might be <- feature_set -i 5 -n notify_ok -v 1

dwilks 2018-05-25 21:38 reporter ~0004659	Just had to help out someone else here that had been force-fed an upgrade to xdebug 2.6.0 through MacPorts. He's on PHP 7.0.

dwilks 2018-06-18 19:03 reporter ~0004673	This appears to be fixed in 2.6.1-dev (downloaded today 18/Jun/2018)

derick 2018-08-01 09:54 administrator ~0004687	I can now confirm that this was indeed a bug in Xdebug 2.6.0, and I can reproduce it. I can also confirm that this is fixed in 2.6.1-dev, which I really ought to release very soon. I think this is a duplicate of https://bugs.xdebug.org/view.php?id=1532

View Issue Details

Relationships

Activities