Assertion failure in ext/ffi/ffi.c

[YuanchengJiang]

Description

The following code:

<?php
class Box {
}
class Test {
function __destruct() {
global $box;var_dump($box);
}
}
function test($box) {
$tmp = new Test;var_dump($tmp);
}
$box = new Box();var_dump($box);
$box->value = new Test;var_dump($box);
test($box);var_dump($box);
$zend = FFI::cdef("
typedef size_t (*zend_write_func_t)(const char *str, size_t str_length);
extern zend_write_func_t zend_write;
");
$orig_zend_write = clone $zend->zend_write;var_dump($orig_zend_write);
$zend->zend_write = function($str, $len) {
global $orig_zend_write;var_dump($orig_zend_write);
};
echo "Hello World!\n";

Resulted in this output:

object(Box)#1 (1) {
  ["value"php: /home/phpfuzz/WorkSpace/diffphp/php-src/ext/ffi/ffi.c:2127: HashTable *zend_ffi_cdata_get_debug_info(zend_object *, int *): Assertion `0' failed.
Aborted (core dumped)

and in JIT 1215:

object(Box)#1 (1) {
  ["value"NULL                         // (broken output)
  object(Test)#2 (0) {
  }
}

PHP Version

nightly

Operating System

ubuntu 22.04

[devnexen]

Can t reproduce with jit set to 1215 but with 1211 locally.

[nielsdos]

This is unrelated to JIT.
The code is equivalent to this:

<?php
class Test {
    function __destruct() {
        echo "hi";
    }
}

$test = new Test;

$zend = FFI::cdef("
typedef size_t (*zend_write_func_t)(const char *str, size_t str_length);
extern zend_write_func_t zend_write;
");
$zend->zend_write = function($str, $len) {};

So what you're doing here is overriding zend_write with a custom callback. The callback data is only alive as long as $zend is alive. When the live variables are destroyed we first destroy $zend, invalidating the callback zend_write; and then we call the destructor of Test. The destructor of Test tries to echo a string, but this wants to call into the callback zend_write to do that which now points to invalid memory, causing a crash.

This is not a bug. FFI opens the door to do anything that C can do. Managing lifetimes is the user's responsibility. Besides that, people shouldn't try overriding the Zend callbacks.