# Bug #70805 (Segmentation faults whilst running Drupal 8 test suite)

- Thread: https://externals.io/message/89059
- Original archive: https://news-web.php.net/php.internals/89059
- Started by Dmitry Stogov on 2015-11-03T19:58:14+00:00
- Messages: 5
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #89059 — Dmitry Stogov — 2015-11-03T19:58:14+00:00

URL: https://externals.io/message/89059#89059

Hi,

I think, I found the root problem of https://bugs.php.net/bug.php?id=70805

unset($a) or unser($GLOBAL["a"]) triggered GC and destructors calls that
tried to release the same global variable $a  once again. As result it's
reference counter was decremented twice and this caused use-after-free,
double-free, etc.

The proposed cumulative fix for all related problems:

https://gist.github.com/dstogov/7aa9d24876e2b3fce8c5

Xinchen, could you please review and verify this once again,
then add necessary tests and commit.

Thanks. Dmitry.

---

## #89061 — Xinchen Hui — 2015-11-04T01:58:50+00:00

URL: https://externals.io/message/89059#89061 · In reply to: #89059

Hey:





> Hi,
>
> I think, I found the root problem of https://bugs.php.net/bug.php?id=70805
>
> unset($a) or unser($GLOBAL["a"]) triggered GC and destructors calls that
> tried to release the same global variable $a  once again. As result it's
> reference counter was decremented twice and this caused use-after-free,
> double-free, etc.
>
> The proposed cumulative fix for all related problems:
>
> https://gist.github.com/dstogov/7aa9d24876e2b3fce8c5
>
> Xinchen, could you please review and verify this once again,
> then add necessary tests and commit.
>
No problem, all issues we met are resovled , thanks :)

tested and committed.

and aslo thanks the fabian who provides us ssh access to a reproducible box
(it's really hard to reproduce locally)

thanks!

>
> Thanks. Dmitry.
>



-- 
Xinchen Hui
@Laruence
http://www.laruence.com/

---

## #89062 — Paul Dragoonis — 2015-11-04T02:10:25+00:00

URL: https://externals.io/message/89059#89062 · In reply to: #89061

Hey,

Looking at the patch, the changes to zend_vm_def.h and zend_vm_execute.h
are duplicated in 10 locations. I'm wondering if we can consolidate this
into maintainable function/macro to handle this?



> Hey:
>
>
>
> 
>
> > […]
> https://bugs.php.net/bug.php?id=70805
> > […]
> No problem, all issues we met are resovled , thanks :)
>
> tested and committed.
>
> and aslo thanks the fabian who provides us ssh access to a reproducible box
> (it's really hard to reproduce locally)
>
> thanks!
>
> > […]
>
>
>
> --
> Xinchen Hui
> @Laruence
> http://www.laruence.com/

---

## #89063 — Bob Weinand — 2015-11-04T02:26:49+00:00

URL: https://externals.io/message/89059#89063 · In reply to: #89062

Hey,

zend_vm_execute.h is an auto-generated file, via zend_vm_gen.php. In reality the patch only fixes the code in exactly one location (zend_vm_def.h) and then regenerated zend_vm_execute.h.

Bob

> Am 04.11.2015 um 03:10 schrieb Paul Dragoonis <dragoonis@gmail.com>:
> 
> Hey,
> 
> Looking at the patch, the changes to zend_vm_def.h and zend_vm_execute.h
> are duplicated in 10 locations. I'm wondering if we can consolidate this
> into maintainable function/macro to handle this?
> 
> 
> 
> > […]

---

## #89067 — Paul Dragoonis — 2015-11-04T10:27:47+00:00

URL: https://externals.io/message/89059#89067 · In reply to: #89063

Hey Bob,

Thanks, it was 2am and quite sleepy so wasn't considering the gen'd files.

Thanks for clarifying!



> Hey,
>
> zend_vm_execute.h is an auto-generated file, via zend_vm_gen.php. In
> reality the patch only fixes the code in exactly one location
> (zend_vm_def.h) and then regenerated zend_vm_execute.h.
>
> Bob
>
> > […]
> that
> > […]
> it's
> > […]
> box
> > […]