Assertion `(zend_gc_refcount(&(ht)->gc) == 1) || ((ht)->u.flags & (1<<6))' failed.
Open
Nobody has claimed this yet.
Bug
Category: Engine
Status: Verified
- Dominant language
- C
- Stars
- 40.4k
- Forks
- 8.1k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 96
Description
Description
The following code:
<?[$i]=$i[]=$i=&$Yhh;$i[$m==$i[]=$i];$h=$i[$m==$i[]=0]+=$Yhh;
Resulted in this output:
Zend/zend_hash.c:1007: zval *_zend_hash_index_add_or_update_i(HashTable *, zend_ulong, zval *, uint32_t): Assertion `(zend_gc_refcount(&(ht)->gc) == 1) || ((ht)->u.flags & (1<<6))' failed.
Reproduce steps:
./configure --disable-all --enable-address-sanitizer --disable-phpdbg --disable-cgi --with-pic --enable-debug-assertions
make -j
./sapi/cli/php -f poc.php
Git commit: b96b88b669370e1d85b6e98e359649d73b548029
PS: Without the debug assertions, the poc doesn't trigger a crash or abort by sanitizer.
PHP Version
PHP 8.3.0-dev
Operating System
Ubuntu 20.04
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Build PHP with the configure and make commands in the issue, then run poc.php through sapi/cli/php to reproduce the assertion. Inspect Zend/zend_hash.c around _zend_hash_index_add_or_update_i at line 1007; done means the provided reproducer no longer triggers the assertion in the stated debug-assertions build.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, php
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100