Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:81470
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain lerdorf.com designates 209.85.192.54 as permitted sender)
Message-ID: <54CC8115.20705@lerdorf.com>
Date: Fri, 30 Jan 2015 23:15:33 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0
MIME-Version: 1.0
To: Michael Wallner <mike@php.net>
CC: PHP Internals <internals@lists.php.net>
References: <54CC625E.8030802@lerdorf.com> <CALJZF3gcNP_9Xq-hO74GD2N89E8fSf32asn2D6z5BVgH2UzCwA@mail.gmail.com>
In-Reply-To: <CALJZF3gcNP_9Xq-hO74GD2N89E8fSf32asn2D6z5BVgH2UzCwA@mail.gmail.com>
Content-Type: multipart/signed; micalg=pgp-sha1;
 protocol="application/pgp-signature";
 boundary="fd61srIG5ksJHsj0klF3jiAV4e1fDXGId"
Subject: Re: [PHP-DEV] Magic getter bug tickled by Moodle
From: rasmus@lerdorf.com (Rasmus Lerdorf)

--fd61srIG5ksJHsj0klF3jiAV4e1fDXGId
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

On 01/30/2015 11:13 PM, Michael Wallner wrote:
>=20
> On 31 Jan 2015 06:04, "Rasmus Lerdorf" <rasmus@lerdorf.com
> <mailto:rasmus@lerdorf.com>> wrote:
>>
>> There is something weird going on with PHP7 and the moodle_page class
>> and all its magic methods. It dies with a:
>>
>> /var/www/moodle/blocks/navigation/block_navigation.php(223) : Notice -=

>> Undefined property: moodle_page::$navigation
>> /var/www/moodle/blocks/navigation/block_navigation.php(223) : Fatal
>> error - __clone method called on non-object
>>
>> That code is:
>>
>> 222   $this->page->navigation->initialise();
>> 223   return clone($this->page->navigation);
>>
>> See:
>>
> https://github.com/moodle/moodle/blob/master/blocks/navigation/block_na=
vigation.php#L222-L223
>>
>> $this->page_navigation is created on that initial call through the
>> wonders of this magic:
>>
>> https://github.com/moodle/moodle/blob/master/lib/pagelib.php#L757-L772=

>>
>> Which somehow leads us to read 8 bytes in a free'ed block:
>>
>> https://gist.github.com/anonymous/f9d1f53b1205d29d86cc
>>
>> but I am not having much luck dwindling it down to a simpler reproduce=

>> case. If you know this code or have a couple of hours to spare, could
>> you see if you could reduce it to something more manageable for us?
>>
>> (and yes, same code is fine in 5.6)
>>
>=20
> Here's a similar bug,  too: https://bugs.php.net/bug.php?id=3D68933&edi=
t=3D1

Ah, good catch. Yes,
https://gist.github.com/arjenschol/3d94195ca51aa44db1c6 looks like a
similar pattern to what Moodle is doing in that part of the code that
seems to trigger this.

-Rasmus


--fd61srIG5ksJHsj0klF3jiAV4e1fDXGId
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlTMgRYACgkQlxayKTuqOuDGNACfQSCsKrmWZwhul8EQGVGo+YOg
muYAnA9uwsj6vAuD9L9CkSeX1lpVfnAZ
=unIr
-----END PGP SIGNATURE-----

--fd61srIG5ksJHsj0klF3jiAV4e1fDXGId--