Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:88739 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 82524 invoked from network); 10 Oct 2015 18:51:48 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 10 Oct 2015 18:51:48 -0000 X-Host-Fingerprint: 176.248.2.89 unknown Received: from [176.248.2.89] ([176.248.2.89:27567] helo=localhost.localdomain) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id EB/84-44453-34E59165 for ; Sat, 10 Oct 2015 14:51:48 -0400 Message-ID: To: internals@lists.php.net References: Date: Sat, 10 Oct 2015 19:51:40 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:41.0) Gecko/20100101 Firefox/41.0 SeaMonkey/2.38 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Posted-By: 176.248.2.89 Subject: Re: Forbid rebinding scope of closures created by ReflectionFunctionAbstract::getClosure() From: ajf@ajf.me (Andrea Faulds) Hi Nikita, Nikita Popov wrote: > > We have recently been reviewing the interaction between > ReflectionFunctionAbstract::getClosure(), a mechanism which converts an > ordinary function or method into a "fake" closure, and closure rebinding > using Closure::bindTo() and Closure::call(). > > It turns out that this combination has not yet received testing and > multiple crashes and leaks were found and fixed [1] [2] [3] [4]. > In hindsight, it is probably my fault that this wasn't spotted sooner. I should've considered the case of ::getClosure() when I wrote Closure::call(). > We have one last outstanding changeset [5] waiting to land, which we want > to check back with internals first, as it constitutes a BC break late in > the PHP 7.0 release cycle. > > This changeset forbids rebinding the *scope* of closures returned by > getClosure() completely. This sounds like a reasonable approach to dealing with the problem. We already have some restrictions with internal function Closures anyway, I don't think this will hurt much, especially since cases where you need to rebind methods into different scopes are quite rare. So, +1 from me. Thanks. -- Andrea Faulds http://ajf.me/