Skip to content

stack-overflow at zend_hash_compare #18572

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Just-do-st opened this issue May 16, 2025 · 8 comments
Closed

stack-overflow at zend_hash_compare #18572

Just-do-st opened this issue May 16, 2025 · 8 comments

Comments

@Just-do-st
Copy link

Just-do-st commented May 16, 2025

Description

The following code:

<?php

class Node
{
/** @var "\xf7\x17\x public $previous;
    /** @var Node */
public $next;
}

var_dump(gc_enabled());
var_dump('start');

$firstNode = new Node();
$firstNode->previous = $firstNode;
$firstNode->next = $fiQstNode;

$circularDoublyLinkedList = $firstNode;

for ($i = 0; $i < 200000; $i++) {
$currentNode = $circularDoublyLinkedList;
    $nextNode = $circularDoublyLinkedList->next;

$newNode = new Node();

$newNode->previous = $currentNode;
    $currentNode->next = $newNode;
    $newNode->next = $nextNode;
    $nextNoode;

    $circularDoublyLinkedList!= $nextNode;
}
var_dump('end');
?>

Resulted in this output:

Deprecated: Creation of dynamic property Node::$previous is deprecated in /out/out-php/clien2/crashes/id:000000,sig:11,src:022560,time:354712457,execs:8340613,op:havoc,rep:2 on line 25
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2895680==ERROR: AddressSanitizer: stack-overflow on address 0x7fffff7feff8 (pc 0x55555ba7c6bf bp 0x7fffff7ff0e0 sp 0x7fffff7ff000 T0)
    #0 0x55555ba7c6be in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x65286be)
    #1 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #2 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #3 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #4 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #5 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #6 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #7 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #8 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #9 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #10 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #11 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #12 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #13 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #14 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #15 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #16 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #17 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #18 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #19 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #20 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #21 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #22 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #23 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #24 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #25 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #26 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #27 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #28 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #29 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #30 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #31 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #32 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #33 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #34 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #35 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #36 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #37 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #38 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #39 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #40 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #41 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #42 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #43 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #44 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #45 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #46 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #47 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #48 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #49 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #50 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #51 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #52 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #53 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #54 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #55 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #56 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #57 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #58 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #59 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #60 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #61 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #62 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #63 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #64 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #65 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #66 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #67 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #68 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #69 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #70 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #71 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #72 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #73 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #74 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #75 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #76 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #77 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #78 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #79 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #80 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #81 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #82 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #83 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #84 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #85 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #86 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #87 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #88 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #89 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #90 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #91 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #92 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #93 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #94 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #95 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #96 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #97 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #98 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #99 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #100 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #101 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #102 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #103 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #104 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #105 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #106 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #107 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #108 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #109 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #110 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #111 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #112 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #113 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #114 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #115 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #116 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #117 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #118 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #119 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #120 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #121 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #122 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #123 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #124 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #125 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #126 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #127 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #128 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #129 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #130 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #131 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #132 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #133 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #134 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #135 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #136 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #137 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #138 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #139 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #140 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #141 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #142 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #143 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #144 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #145 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #146 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #147 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #148 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #149 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #150 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #151 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #152 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #153 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #154 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #155 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #156 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #157 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #158 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #159 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #160 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #161 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #162 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #163 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #164 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #165 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #166 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #167 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #168 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #169 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #170 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #171 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #172 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #173 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #174 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #175 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #176 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #177 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #178 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #179 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #180 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #181 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #182 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #183 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #184 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #185 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #186 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #187 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #188 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #189 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #190 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #191 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #192 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #193 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #194 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #195 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #196 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #197 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #198 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #199 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #200 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #201 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #202 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #203 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #204 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #205 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #206 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #207 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #208 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #209 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #210 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #211 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #212 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #213 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #214 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #215 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #216 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #217 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #218 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #219 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #220 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #221 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #222 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #223 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #224 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #225 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #226 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #227 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #228 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #229 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #230 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #231 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #232 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #233 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #234 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #235 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #236 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #237 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #238 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #239 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #240 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #241 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #242 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #243 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)
    #244 0x55555bca3c5e in hash_zval_compare_function (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc5e)
    #245 0x55555ba7ca6e in zend_hash_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6528a6e)
    #246 0x55555bca3c9a in zend_compare_symbol_tables (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x674fc9a)
    #247 0x55555bc1066d in zend_std_compare_objects (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x66bc66d)
    #248 0x55555bc8be22 in zend_compare (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x6737e22)

SUMMARY: AddressSanitizer: stack-overflow (/crash-replay/php-src-php-8.4.7/sapi/cli/php+0x65286be) in zend_hash_compare
==2895680==ABORTING

PHP Version

latest and php-src-php-8.4.7

/php-src-php-8.4.7/sapi/cli# ./php -v
PHP 8.4.7 (cli) (built: May 16 2025 18:29:47) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.4.7, Copyright (c) Zend Technologies

Operating System

ubuntu 20.04

@devnexen
Copy link
Member

@nielsdos (or @arnaud-lb) is it again the infinite stack overflow issue ?

@arnaud-lb
Copy link
Member

Yes. There is a deep recursion in zend_std_compare_objects when objects are deeply nested. zend_std_compare_objects doesn't enter the VM, so zend.max_allowed_stack_size is not effective.

Updating zend_std_compare_objects or zend_hash_compare to be non-recursive is difficult, but we could add manual checks in zend_std_compare_objects or zend_hash_compare like in

if (php_json_check_stack_limit()) {

@devnexen
Copy link
Member

devnexen commented May 16, 2025

I tried a bit locally with 8.3 and your suggestion, still occurs ; not sure what is the appropriate ini version would be but I may go back at it later today.

@nielsdos
Copy link
Member

Right. If the overhead of checking the stack limit in zend_std_compare_objects is low (probably is as it's probably a rare thing to do), then we could add a check indeed which would throw + return ZEND_UNCOMPARABLE.

devnexen added a commit to devnexen/php-src that referenced this issue May 16, 2025
With nested objects and recursive comparisons, it is for now unavoidable
to have a stack overflow we do some early damage control attempt early
on with zend.max_allowed_stack_size check but ultimately more a band-aid
than a definitive solution.
@devnexen
Copy link
Member

while looking for a simpler reproducer this case triggers another, possibly known, bug

class Node {
    public $next; 
}

$n = new Node();
$n->next = $n; 
$n->previous = $n;

for ($i = 0; $i < 200000; $i++) {
    $new = new Node();
    $new->next = $n;
    $new->previous = $n;
    $n = $new;
}
...
#71 0x0000555555d9fc6c in i_zval_ptr_dtor (zval_ptr=0x7ffff14f11a8) at /home/dcarlier/Contribs/php-src/Zend/zend_variables.h:44
#72 0x0000555555da01b3 in zend_object_std_dtor (object=0x7ffff14f1180) at /home/dcarlier/Contribs/php-src/Zend/zend_objects.c:77
#73 0x0000555555da82fc in zend_objects_store_del (object=0x7ffff14f1180) at /home/dcarlier/Contribs/php-src/Zend/zend_objects_API.c:200
#74 0x0000555555c9ecf5 in rc_dtor_func (p=0x7ffff14f1180) at /home/dcarlier/Contribs/php-src/Zend/zend_variables.c:57
#75 0x0000555555d9fc6c in i_zval_ptr_dtor (zval_ptr=0x7ffff14f1268) at /home/dcarlier/Contribs/php-src/Zend/zend_variables.h:44
#76 0x0000555555da01b3 in zend_object_std_dtor (object=0x7ffff14f1240) at /home/dcarlier/Contribs/php-src/Zend/zend_objects.c:77
#77 0x0000555555da82fc in zend_objects_store_del (object=0x7ffff14f1240) at /home/dcarlier/Contribs/php-src/Zend/zend_objects_API.c:200
#78 0x0000555555c9ecf5 in rc_dtor_func (p=0x7ffff14f1240) at /home/dcarlier/Contribs/php-src/Zend/zend_variables.c:57
#79 0x0000555555d9fc6c in i_zval_ptr_dtor (zval_ptr=0x7ffff14f1328) at /home/dcarlier/Contribs/php-src/Zend/zend_variables.h:44
#80 0x0000555555da01b3 in zend_object_std_dtor (object=0x7ffff14f1300) at /home/dcarlier/Contribs/php-src/Zend/zend_objects.c:77
#81 0x0000555555da82fc in zend_objects_store_del (object=0x7ffff14f1300) at /home/dcarlier/Contribs/php-src/Zend/zend_objects_API.c:200
...

@nielsdos
Copy link
Member

while looking for a simpler reproducer this case triggers another, possibly known, bug

Variant of #15869 essentially, I thought there was another one that had closer resemblance but I can't find it now

devnexen added a commit that referenced this issue May 17, 2025
With nested objects and recursive comparisons, it is for now unavoidable
to have a stack overflow we do some early damage control attempt early
on with zend.max_allowed_stack_size check but ultimately more a band-aid
than a definitive solution.

close GH-18577
@devnexen
Copy link
Member

Very partially fixed with the above PR, I keep it opened but feel free to close it is there a same report for this particular case.

@nielsdos
Copy link
Member

I'll close it then, the recursive destruction stack overflow is well known.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants