| CARVIEW |
Select Language
HTTP/2 200
date: Tue, 30 Dec 2025 10:43:16 GMT
content-type: text/html; charset=utf-8
cache-control: max-age=0, private, must-revalidate
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com marketplace-screenshots.githubusercontent.com/ copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
link: ; rel=preload; as=fetch; crossorigin=use-credentials
referrer-policy: no-referrer-when-downgrade
server-timing: issue_layout-fragment;desc="issue_layout fragment";dur=229.413708,issue_conversation_content-fragment;desc="issue_conversation_content fragment";dur=930.215682,nginx;desc="NGINX";dur=0.828369,glb;desc="GLB";dur=97.3093
strict-transport-security: max-age=31536000; includeSubdomains; preload
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With, Accept,Accept-Encoding, Accept, X-Requested-With
x-content-type-options: nosniff
x-frame-options: deny
x-voltron-version: aab62e3
x-xss-protection: 0
server: github.com
content-encoding: gzip
accept-ranges: bytes
set-cookie: _gh_sess=7saPQ5S6hLK7vDLI6YpbMz2oGjZ3zgiXbXwQAEmWtooisRkHs11FbNKymm%2BeKsUuKW4Qheqjse0hRgFuMsSdOLg7rUpEWeGwSR4wSfmvdWzIPZ35BsGpKp6u0n9QkJZXWRgad6UEbQvovOeAtacWL32ZcrUm950jPfCyZ1o2zWIu4LgmCBATDumkWqUQomz2FRAouUMVriSL4mgNwliDm52WMHlwCLU2d1jIghDnSCs9nwwylzPMi7VoHFoFkyXCt%2BDlhW9NsDDux9NvqYUMuw%3D%3D--e5bNrV3UPprboIJW--NCViVXXG1rkdNc3que%2Fixw%3D%3D; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: _octo=GH1.1.1180367438.1767091395; Path=/; Domain=github.com; Expires=Wed, 30 Dec 2026 10:43:15 GMT; Secure; SameSite=Lax
set-cookie: logged_in=no; Path=/; Domain=github.com; Expires=Wed, 30 Dec 2026 10:43:15 GMT; HttpOnly; Secure; SameSite=Lax
x-github-request-id: 800C:262140:79088F:843F52:6953ACC3
Deep recursion in zend_cfg.c causes segfault instead of error · Issue #14361 · php/php-src · GitHub
No one assignedNo typeNo projectsNo milestoneNone yetNo branches or pull requests
Skip to content
Navigation Menu
{{ message }}
-
Notifications
You must be signed in to change notification settings - Fork 8k
Closed
Description
Description
The following code:
<?php
error_reporting(E_ALL ^ E_DEPRECATED);
$binaryOperators = [
"==",
"!=",
"===",
"!==",
"<",
"<=",
">",
">=",
"<=>",
"+",
"-",
"*",
"/",
"%",
"**",
".",
"|",
"&",
"^",
"or",
"and",
"xor",
"||",
"&&",
];
$unaryOperators = [
"~",
"-",
"+",
"!",
];
$input = [
0,
0.0,
1,
2,
-1,
2.0,
2.1,
-2.0,
-2.1,
PHP_INT_MAX,
PHP_INT_MIN,
PHP_INT_MAX * 2,
PHP_INT_MIN * 2,
INF,
NAN,
[],
[1, 2],
[1, 2, 3],
[1 => 2, 0 => 1],
[1, 'a' => 2],
[1, 4],
[1, 'a'],
[1, 2 => 2],
[1, [ 2 ]],
null,
false,
true,
"",
" ",
"banana",
"Banana",
"banan",
"0",
"200",
"20",
"20a",
" \t\n\r\v\f20",
"20 ",
"2e1",
"2e150",
"9179769313486231570814527423731704356798070567525844996598917476803157260780028538760589558632766878171540458953514382464234321326889464182768467546703537516986049910576551282076245490090389328944075868508455133942304583236903222948165808559332123348274797826204144723168738177180919299881250404026184124858368",
"-9179769313486231570814527423731704356798070567525844996598917476803157260780028538760589558632766878171540458953514382464234321326889464182768467546703537516986049910576551282076245490090389328944075868508455133942304583236903222948165808559332123348274797826204144723168738177180919299881250404026184124858368",
"0.1",
"-0.1",
"1e-1",
"-20",
"-20.0",
"0x14",
(string) PHP_INT_MAX * 2,
(string) PHP_INT_MIN * 2,
];
function makeParam($param) {
if ($param === PHP_INT_MIN) {
return "PHP_INT_MIN";
}
if ($param === PHP_INT_MAX) {
return "PHP_INT_MAX";
}
if (is_string($param)) {
return '"' . strtr($param, ["\t" => '\t', "\n" => '\n', "\r" => '\r', "\v" => '\v', "\f" => '\f', '$' => '\$', '"' => '\"']) . '"';
}
return "(" . str_replace("\n", "", var_export($param, true)) . ")";
}
$c = 0;
$f = 0;
function prepareBinaryLine($op1, $op2, $cmp, $operator) {
$op1_p = makeParam($op1);
$op2_p = makeParam($op2);
$error = "echo '" . addcslashes("$op1_p $operator $op2_p", "\\'") . '\', "\n"; $f++;';
$compare = "@($op1_p $operator $op2_p)";
$line = "\$c++; ";
try {
$result = makeParam($cmp());
$line .= "if (" . ($result === "(NAN)" ? "!is_nan($compare)" : "$compare !== $result") . ") { $error }";
} catch (Throwable $e) {
$msg = makeParam($e->getMessage());
$line .= "try { $compare; $error } catch (Error \$e) { if (\$e->getMessage() !== $msg) { $error } }";
}
return $line;
}
function prepareUnaryLine($op, $cmp, $operator) {
$op_p = makeParam($op);
$error = "echo '" . addcslashes("$operator $op_p", "\\'") . '\', "\n"; $f++;';
$compare = "@($operator $op_p)";
$line = "\$c++; ";
try {
$result = makeParam($cmp());
$line .= "if (" . ($result === "(NAN)" ? "!is_nan($compare)" : "$compare !== $result") . ") { $error }";
} catch (Throwable $e) {
$msg = makeParam($e->getMessage());
$line .= "try { $compare; $error } catch (Error \$e) { if (\$e->getMessage() !== $msg) { $error } }";
}
return $line;
}
$filename = __DIR__ . DIRECTORY_SEPARATOR . 'compare_binary_operands_temp.php';
$file = fopen($filename, "w");
fwrite($file, "<?php\n");
foreach ($input as $left) {
foreach ($input as $right) {
foreach ($binaryOperators as $operator) {
$line = prepareBinaryLine($left, $right, function() use ($left, $right, $operator) {
return eval("return @(\$left $operator \$right);");
}, $operator);
fwrite($file, $line . "\n");
}
}
}
foreach ($input as $right) {
foreach ($unaryOperators as $operator) {
$line = prepareUnaryLine($right, function() use ($right, $operator) {
return eval("return @($operator \$right);");
}, $operator);
fwrite($file, $line . "\n");
}
}
fclose($file);
include $filename;
if($c === 0) {
echo "Completely failed\n";
} else {
echo "Failed: $f\n";
}
?>
This is the php code from Zend/tests/runtime_compile_time_binary_operands.phpt
Resulted in this output:
AddressSanitizer:DEADLYSIGNAL
=================================================================
==4050933==ERROR: AddressSanitizer: stack-overflow on address 0x7fff10533fff (pc 0x55698135c573 bp 0x7fff10534310 sp 0x7fff10533fb0 T0)
#0 0x55698135c573 in zend_mark_reachable /WorkSpace/phptest/php-src/Zend/Optimizer/zend_cfg.c:89:16
#1 0x55698135c839 in zend_mark_reachable /WorkSpace/phptest/php-src/Zend/Optimizer/zend_cfg.c:100:6
#2 0x55698135c839 in zend_mark_reachable /WorkSpace/phptest/php-src/Zend/Optimizer/zend_cfg.c:100:6
#3 0x55698135c839 in zend_mark_reachable /WorkSpace/phptest/php-src/Zend/Optimizer/zend_cfg.c:100:6
#4 0x55698135c839 in zend_mark_reachable /WorkSpace/phptest/php-src/Zend/Optimizer/zend_cfg.c:100:6
...
#246 0x55698135c839 in zend_mark_reachable /WorkSpace/phptest/php-src/Zend/Optimizer/zend_cfg.c:100:6
SUMMARY: AddressSanitizer: stack-overflow /WorkSpace/phptest/php-src/Zend/Optimizer/zend_cfg.c:89:16 in zend_mark_reachable
or
AddressSanitizer:DEADLYSIGNAL
=================================================================
==3759932==ERROR: AddressSanitizer: BUS on unknown address (pc 0x7f7d6b8ab860 bp 0x7ffc84b5c620 sp 0x7ffc84b5c5a8 T0)
==3759932==The signal is caused by a READ memory access.
==3759932==Hint: this fault was caused by a dereference of a high value address (see register values below). Disassemble the provided pc to learn which register was used.
AddressSanitizer:DEADLYSIGNAL
AddressSanitizer: nested bug in the same thread, aborting.
But I expected this output instead:
Failed: 0
To reproduce:
/php-src/sapi/cli/php -n -c '/php-src/tmp-php.ini' -d "memory_limit=256M" -d "opcache.fast_shutdown=0" -d "opcache.file_update_protection=0" -d "opcache.revalidate_freq=0" -d "opcache.jit_hot_loop=1" -d "opcache.jit_hot_func=1" -d "opcache.jit_hot_return=1" -d "opcache.jit_hot_side_exit=1" -d "opcache.jit_max_root_traces=100000" -d "opcache.jit_max_side_traces=100000" -d "opcache.jit_max_exit_counters=100000" -d "opcache.protect_memory=1" -d "extension_dir=/php-src/modules/" -d "zend_extension=/php-src/modules/opcache.so" -d "session.auto_start=0" -d "opcache.enable=1" -d "opcache.enable_cli=1" -d "opcache.jit=tracing" -d "opcache.optimization_level=0x000000a0" -f ./test.php
I did not meet such infinite loop before. I am not sure if it is expected. Please kindly close it if everything works well.
PHP Version
nightly
Operating System
ubuntu 22.04
Metadata
Metadata
Assignees
Type
Projects
Milestone
Relationships
Development
Issue actions
You can’t perform that action at this time.