SplFixedArray corrupted

[mvorisek]

Description

I have investigated some weird behaviour and I came to a conclusion it must be an issue in php-src.

Steps to reproduce:

1. clone https://github.com/mvorisek/PHP-CS-Fixer/tree/fix_tokens_cache_8228
2. run composer update
3. run php repro.php
4. notice output "BUG DETECTED!!"

In the repro branch, there are 3 important files:

• the repro.php file that can reproduce the issue consistently,
• https://github.com/mvorisek/PHP-CS-Fixer/blob/cbfd08b544/.github/workflows/ci.yml which reproduces the issue in CI,
• and https://github.com/mvorisek/PHP-CS-Fixer/blob/cbfd08b544/src/Tokenizer/Tokens.php#L46

The last file/line is very interesting. How can foreach ($this as $t) {} have an effect on the result?

a) I know, the $t is kept allocated until out of scope, but that is not decisive here (tested)
b) the $this is a class that extends \SplFixedArray, but the getIterator() method is not extended (nor getSize(), count(), offsetGet()), so the foreach should have zero effect

The foreach ($this as $t) {} however fix the corruption! So I guess there is something wrong in php-src internally.

For unknown reasons, the "foreach fix" is working on PHP 7.4 only. I know PHP 7.4 is EOL, but can someone please reproduce the issue on PHP 7.4 and answer why foreach ($this as $t) {} is fixing the problem, ie. what internal/php-src side effects it does?

I guess with this question answered, it would be easy to understand this main issue even for higher/latest php version(s).

PHP Version

any

Operating System

any (tested Windows and linux)

[iluuu1994]

Have you checked how the foreach changes the output of $new? It seems more likely that this is a bug in 7.4 that was fixed.

b) the $this is a class that extends \SplFixedArray, but the getIterator() method is not extended (nor getSize(), count(), offsetGet()), so the foreach should have zero effect

\SplFixedArray does declare getIterator() internally, which invokes spl_fixedarray_get_iterator().

Can you please try to minimize the reproducer?

[mvorisek]

Would you please mind running the reproduced on PHP 7.4 src and compare the internal php-src memory after and before the foreach?

My idea is then it should be easy to understand the issue and create simple test for it.

[iluuu1994]

Sorry, debugging old versions is time consuming (I tried compiling and I'm missing OpenSSL 1.1). We can't help you if it's not even clear there is a bug in a supported version.

[mvorisek]

I will reopen once I have more feedback.