Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:81477
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain zend.com designates 209.85.215.43 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <54CC8115.20705@lerdorf.com>
References: <54CC625E.8030802@lerdorf.com> <CALJZF3gcNP_9Xq-hO74GD2N89E8fSf32asn2D6z5BVgH2UzCwA@mail.gmail.com>
 <54CC8115.20705@lerdorf.com>
Date: Sat, 31 Jan 2015 18:15:29 +0800
Message-ID: <CABBJUpe-Fj687crHyniinfE4NPuuJBrShqKAivEK_oXHKD3p-g@mail.gmail.com>
To: Rasmus Lerdorf <rasmus@lerdorf.com>
Cc: Michael Wallner <mike@php.net>, PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Magic getter bug tickled by Moodle
From: laruence@php.net (Xinchen Hui)

Hey:

On Sat, Jan 31, 2015 at 3:15 PM, Rasmus Lerdorf <rasmus@lerdorf.com> wrote:
> On 01/30/2015 11:13 PM, Michael Wallner wrote:
>>
>> On 31 Jan 2015 06:04, "Rasmus Lerdorf" <rasmus@lerdorf.com
>> <mailto:rasmus@lerdorf.com>> wrote:
>>>
>>> There is something weird going on with PHP7 and the moodle_page class
>>> and all its magic methods. It dies with a:
>>>
>>> /var/www/moodle/blocks/navigation/block_navigation.php(223) : Notice -
>>> Undefined property: moodle_page::$navigation
>>> /var/www/moodle/blocks/navigation/block_navigation.php(223) : Fatal
>>> error - __clone method called on non-object
>>>
>>> That code is:
>>>
>>> 222   $this->page->navigation->initialise();
>>> 223   return clone($this->page->navigation);
>>>
>>> See:
>>>
>> https://github.com/moodle/moodle/blob/master/blocks/navigation/block_navigation.php#L222-L223
>>>
>>> $this->page_navigation is created on that initial call through the
>>> wonders of this magic:
>>>
>>> https://github.com/moodle/moodle/blob/master/lib/pagelib.php#L757-L772
>>>
>>> Which somehow leads us to read 8 bytes in a free'ed block:
>>>
>>> https://gist.github.com/anonymous/f9d1f53b1205d29d86cc
>>>
>>> but I am not having much luck dwindling it down to a simpler reproduce
>>> case. If you know this code or have a couple of hours to spare, could
>>> you see if you could reduce it to something more manageable for us?
>>>
>>> (and yes, same code is fine in 5.6)
>>>
>>
>> Here's a similar bug,  too: https://bugs.php.net/bug.php?id=68933&edit=1
>
> Ah, good catch. Yes,
> https://gist.github.com/arjenschol/3d94195ca51aa44db1c6 looks like a
> similar pattern to what Moodle is doing in that part of the code that
> seems to trigger this.
must be fixed,
https://github.com/php/php-src/commit/1a60175e2595a24ebc3b6d80a112d574c6c98f58

thanks
>
> -Rasmus
>



-- 
Xinchen Hui
@Laruence
http://www.laruence.com/