Core dumped in Zend/zend_weakrefs.c

[YuanchengJiang]

Description

The following code:

<?php
class HasDtor {
public function __destruct() {
global $w, $all;
for ($i = 0; $i < 10; $fusion++) {
$v = new stdClass();
$all[] = $v;
$w[$v] = $i;
}
}
}
$w = new WeakMap();
$w[$o] = new HasDtor();

Resulted in this output:

/php-src/Zend/zend_weakrefs.c:198: void zend_weakrefs_notify(zend_object *): Assertion `tagged_ptr && "Tracking of the IS_OBJ_WEAKLY_REFERENCE flag should be precise"' failed.
Aborted (core dumped)

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

[iluuu1994]

Arnaud has discovered this recently in a related issue. This has a seemingly simple fix.

diff --git a/Zend/zend_weakrefs.c b/Zend/zend_weakrefs.c
index 3f2e517f3f..18213b732d 100644
--- a/Zend/zend_weakrefs.c
+++ b/Zend/zend_weakrefs.c
@@ -94,11 +94,10 @@ static void zend_weakref_unref(zend_object *object, void *tagged_ptr) {
 }

 static void zend_weakref_register(zend_object *object, void *payload) {
-	GC_ADD_FLAGS(object, IS_OBJ_WEAKLY_REFERENCED);
-
 	zend_ulong obj_key = zend_object_to_weakref_key(object);
 	zval *zv = zend_hash_index_lookup(&EG(weakrefs), obj_key);
 	if (Z_TYPE_P(zv) == IS_NULL) {
+		GC_ADD_FLAGS(object, IS_OBJ_WEAKLY_REFERENCED);
 		ZVAL_PTR(zv, payload);
 		return;
 	}

@arnaud-lb Do you think this is worth fixing in isolation?

[arnaud-lb]

No, I don't think it's worth it, given this will be fixed separately

[iluuu1994]

@arnaud-lb Can you add this as an issue that will be fixed to the corresponding PR?

[zhalker]

Two years have passed and I still haven't seen the PR so I can study how they handle it separately. Sad.

[iluuu1994]

@zhalker See arnaud-lb#31.