# serious bug in PHP 6 ZE

- Thread: https://externals.io/message/45168
- Original archive: https://news-web.php.net/php.internals/45168
- Started by Greg Beaver on 2009-07-31T19:21:07+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #45168 — Greg Beaver — 2009-07-31T19:21:07+00:00

URL: https://externals.io/message/45168#45168

Hi,

After quite a while of trying, I've tracked down the problem that is
causing occasional segfaults in run-tests.php in PHP 6.

Basically, here's what happens:

on line 1652, we call system_with_timeout() to run the test, passing in
a CV ($cmd) containing the command line to execute to run the test.  In
the cleanup of the active symbol table when returning from
system_with_timeout(), the refcount of $commandline is not correct, and
so the $cmd zval is efreed.  At some random points, the return value of
the run_test() occupies the same space that $cmd once occupied, gets
efreed, and we crash.

To get a segfault every time, put a simple var_dump($cmd); on line 1653
in run-tests.php and do "make test"

So, it seems that either refcounting is not incrementing enough, or
decrementing too much in PHP 6.

Greg