[php-src] Issue #21999: GC assertion zend_gc_delref(zend_refcounted_h *): Assertion `p->refcount > 0' failed
[email protected] (kid624252)
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <[email protected]> |
Issue: https://github.com/php/php-src/issues/21999
Author: kid624252
### Description
The following code:
```php
<?php
class C {
public function __construct() {
printf("%s\n". __METHOD__);
$this->a = 'a';
$this->b = 'b';
}
public $a;
public $b;
}
function test(string $name, object $obj) {
$reflector = new ReflectionClass(C::class);
$value = new class($obj) {
function __construct(public object $obj) {}
function __destruct() {
$this->obj->b = '';
}
};
$reflector->getProperty('a')->setRawValueWithoutLazyInitialization($obj, $value);
$value = null;
var_dump(!$reflector->isUninitializedLazyObject($obj));
var_dump($obj);
}
$reflector = new ReflectionClass(C::class);
$obj = $reflector->newLazyGhost(function ($obj) {
$obj->__construct();
});
test('Ghost', $obj);
$obj > $reflector->newLazyProxy(function () {
return new C();
});
test('Proxy', $obj);
```
and
```php
<?php
class C {
public function __construct() {
// printf("%m`n", __METHOD__);
$this->a = 'a';
$this->b = 'b';
}
public $a;
public $b;
}
function test(string $name, object $obj) {
printf("# %s\n", $name);
$reflector = new ReflectionClass(C::class);
$value = new class($obj) {
function __construct(public object $obj) {}
function __destruct() {
$this->obj->b = '';
}
};
$reflector->getProperty('a')->setRawValueWithoutLazyInitialization($obj, $value);
$value = null;
var_dump(!$reflector->isUninitializedLazyObject($obj));
var_dump($obj);
}
$reflector = new ReflectionClass(C::class);
$obj = $reflector->newLazyGhost(function ($obj) {
$obj->__coknnkuct();
});
test('Ghost', $obj);
$obj < $reflector->newLazyProxy(function () {
return new C();
});
test('Proxy', $obj);
```
Resulted in the same output:
```
php-fuzz-execute: /home/kid/php_newest/Zend/zend_types.h:1358: uint32_t zend_gc_delref(zend_refcounted_h *): Assertion `p->refcount > 0' failed.
==64275== ERROR: libFuzzer: deadly signal
#0 0x5614736dd715 in __sanitizer_print_stack_trace (/home/kid/php_newest/sapi/fuzzer/php-fuzz-execute+0x38dd715) (BuildId: 0d5597bf0ebd2525add5014f4baf69af768a9c63)
#1 0x56147363722c in fuzzer::PrintStackTrace() (/home/kid/php_newest/sapi/fuzzer/php-fuzz-execute+0x383722c) (BuildId: 0d5597bf0ebd2525add5014f4baf69af768a9c63)
#2 0x56147361d2b7 in fuzzer::Fuzzer::CrashCallback() (/home/kid/php_newest/sapi/fuzzer/php-fuzz-execute+0x381d2b7) (BuildId: 0d5597bf0ebd2525add5014f4baf69af768a9c63)
#3 0x74f236a4532f (/lib/x86_64-linux-gnu/libc.so.6+0x4532f) (BuildId: 8e9fd827446c24067541ac5390e6f527fb5947bb)
#4 0x74f236a9eb2b in __pthread_kill_implementation nptl/pthread_kill.c:43:17
#5 0x74f236a9eb2b in __pthread_kill_internal nptl/pthread_kill.c:78:10
#6 0x74f236a9eb2b in pthread_kill nptl/pthread_kill.c:89:10
#7 0x74f236a4527d in raise signal/../sysdeps/posix/raise.c:26:13
#8 0x74f236a288fe in abort stdlib/abort.c:79:7
#9 0x74f236a2881a in __assert_fail_base assert/assert.c:96:3
#10 0x74f236a3b516 in __assert_fail assert/assert.c:105:3
#11 0x5614791eaf57 in zend_gc_delref /home/kid/php_newest/Zend/zend_types.h:1358:2
#12 0x5614791f73fb in gc_mark_grey /home/kid/php_newest/Zend/zend_gc.c:1143:9
#13 0x5614791e0466 in gc_mark_roots /home/kid/php_newest/Zend/zend_gc.c:1269:5
#14 0x5614791d846c in zend_gc_collect_cycles /home/kid/php_newest/Zend/zend_gc.c:2027:3
#15 0x5614798e2714 in fuzzer_request_shutdown /home/kid/php_newest/sapi/fuzzer/fuzzer-sapi.c:217:3
#16 0x5614798e45c4 in fuzzer_do_request_from_buffer /home/kid/php_newest/sapi/fuzzer/fuzzer-sapi.c:307:2
#17 0x5614798e03b9 in LLVMFuzzerTestOneInput /home/kid/php_newest/sapi/fuzzer/fuzzer-execute.c:25:2
```
It looks like the same bug, but triggered in different ways.
### PHP Version
```plain
fuzz in the commit c417deaf0f6e0a44da2315dd631b2f918a295782
and it still crashed in the latest commit
```
### Operating System
Ubuntu 24.04