[PHP-DEV] Bug #11218 Updated: isset() inside for() loops can crash From: zeev <email protected>
Date: 06/21/01

ID: 11218
Updated by: zeev
Reported By: danielc <email protected>
Old-Status: Open
Status: Feedback
Bug Type: Scripting Engine problem
Operating system:
PHP Version: 4.0.5
Assigned To:
Comments:

I was unable to reproduce that problem, however, I did fix bug #10911 which appears to be based on the same issue. Can you please test the latest CVS and see whether it solves your problem (note, this fix may not be a part of 4.0.6, since 4.0.6 has already been packaged; It'll definitely be in 4.0.7)

Previous Comments:
---------------------------------------------------------------------------

[2001-06-05 17:20:08] danielc <email protected>
Bug 10911, http://www.php.net/bugs.php?id=10911, was brought to my attention. Both my report above and this other one may be based on the same bug.

---------------------------------------------------------------------------

[2001-05-31 12:33:40] danielc <email protected>
<?php

# The problem child...
   function Test($FileName, $FileLine, $Opt='', $Col='') {
      for ($Counter = 0; $Counter < 3; $Counter++) {
         echo '<br />in for ';
         if ( isset($Col['SC']['hide']) ) {
            echo 'in if';
         }
      }
   }
   Test(__FILE__,__LINE__);

# NOW, funny things happen if I change the number of times
# the for loop runs...

# $Counter < 1...
# Everything is fine.

# $Counter < 2...
# Dr Watson notifys of PHP crash, hit OK
# (SeeDr Watson report at end of this posting.)
# Text is displayed in browser.
# PHP no longer running.

# $Counter < 3...
# Nothing returned to browser.
# No Dr Watson reports.
# PHP won't stop executing, takes up 99% of processor time.
# Can't "End Process" in Task Manger.
# Doesn't stop after max execution time.
# Need to reboot to kill PHP process.
#
# Though, if I execute from command line...
# winds up in same infinite loop, but I can
# kill the PHP process from the task manager.

# So, if that's not strange enough, altering the
# test code in small ways eliminates the problem...

# remove if / isset segment...
# okay
/*
   function Test($FileName, $FileLine, $Opt='', $Col='') {
      for ($Counter = 0; $Counter < 3; $Counter++) {
         echo '<br />in for ';
      }
   }
   Test(__FILE__,__LINE__);
*/

# put the if / isset segment back
# BUT remove the for loop....
# okay
/*
   function Test($FileName, $FileLine, $Opt='', $Col='') {
         if ( isset($Col['SC']['hide']) ) {
            echo 'in if';
         }
   }
   Test(__FILE__,__LINE__);
*/

# put the for loop back
# BUT do isset on a single dimensional array...
# okay
/*
   function Test($FileName, $FileLine, $Opt='', $Col='') {
      for ($Counter = 0; $Counter < 3; $Counter++) {
         echo '<br />in for ';
         if ( isset($Col['SC']) ) {
            echo 'in if';
         }
      }
   }
   Test(__FILE__,__LINE__);
*/

# perform tasks outside a function.
# okay
/*
      for ($Counter = 0; $Counter < 3; $Counter++) {
         echo '<br />in for ';
         if ( isset($Col['SC']['hide']) ) {
            echo 'in if';
         }
      }
*/

# set the array before running function
# okay
/*
   $Var['SC']['hide'] = 'y';
   function Test($FileName, $FileLine, $Opt='', $Col='') {
      for ($Counter = 0; $Counter < 3; $Counter++) {
         echo '<br />in for ';
         if ( isset($Col['SC']['hide']) ) {
            echo 'in if';
         }
      }
   }
   Test(__FILE__,__LINE__,'',$Var);
*/

# Set a single dimensional array,
# though continue to perform isset on a two dimensional
# Doesn't crash
# --> _BUT_ the "if isset()" test comes out as TRUE
# --> even when it's actually FALSE!
/*
   unset($Var);
   $Var['SC'] = 'y';
   function Test($FileName, $FileLine, $Opt='', $Col='') {
      for ($Counter = 0; $Counter < 3; $Counter++) {
         echo '<br />in for ';
         if ( isset($Col['SC']['hide']) ) {
            echo 'in if';
         }
      }
   }
   Test(__FILE__,__LINE__,'',$Var);
*/

# Set variable to a string...
# okay
/*
   $Var = 'y';
   function Test($FileName, $FileLine, $Opt='', $Col='') {
      for ($Counter = 0; $Counter < 3; $Counter++) {
         echo '<br />in for ';
         if ( isset($Col['SC']['hide']) ) {
            echo 'in if';
         }
      }
   }
   Test(__FILE__,__LINE__,'',$Var);
*/

/*
Application exception occurred:
        App: (pid=212)
        When: 5/31/2001 @ 11:59:23.314
        Exception number: c0000005 (access violation)

*----> System Information <----*
        Computer Name: BASE
        User Name: SYSTEM
        Number of Processors: 1
        Processor Type: x86 Family 6 Model 3 Stepping 4
        Windows Version: 4.0
        Current Build: 1381
        Service Pack: 6
        Current Type: Uniprocessor Free
        Registered Organization: Analysis and Solutions Company
        Registered Owner: Daniel Convissor

*----> Task List <----*
   0 Idle.exe
   2 System.exe
  20 SMSS.exe
  24 CSRSS.exe
  34 winlogon.exe
  40 SERVICES.exe
  43 LSASS.exe
  66 SPOOLSS.exe
  73 Apache.exe
  80 mysqld-nt.exe
  82 Apache.exe
 137 RPCSS.exe
 153 vsmon.exe
 165 minilog.exe
 189 NDDEAGNT.exe
  42 EXPLORER.exe
 186 LOADWC.exe
 166 zonealarm.exe
 182 NOTEPAD.exe
 183 netscape.exe
 212 php.exe
 218 DRWTSN32.exe
   0 _Total.exe

(00400000 - 00400000)
(77f60000 - 77fbe000) dllntdll.dbg
(10000000 - 10000000)
(77f00000 - 77f5e000) dllkernel32.dbg
(77e70000 - 77ec5000) dlluser32.dbg
(77ed0000 - 77efc000) dllgdi32.dbg
(77dc0000 - 77dff000) dlladvapi32.dbg
(77e10000 - 77e67000) dllrpcrt4.dbg
(776d0000 - 776d8000) dllwsock32.dbg
(776b0000 - 776c4000) dllws2_32.dbg
(78000000 - 78046000)
(776a0000 - 776a7000) dllws2help.dbg
(77b20000 - 77bd7000) dllole32.dbg
(65340000 - 653d2000) oleaut32.dbg
(04a50000 - 04a8c000) odbc32.DBG
(71700000 - 7178a000) COMCTL32.dbg
(77c40000 - 77d7c000) dllshell32.dbg
(77d80000 - 77db2000) dllcomdlg32.dbg
(77a90000 - 77a9b000) dllversion.dbg
(779c0000 - 779c8000) dlllz32.dbg
(780a0000 - 780b2000)
(04a00000 - 04a00000)

State Dump for Thread Id 0xd7

eax=00570720 ebx=00536d70 ecx=0000005b edx=00000000 esi=00570300 edi=00536d70
eip=1008999a esp=0012fe7c ebp=00000004 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246

function: <nosymbols>
        10089983 eb17 jmp 1008999c
        10089985 85c0 test eax,eax
        10089987 740c jz 10089995
        10089989 3b7704 cmp esi,[edi+0x4] ds:01455776=????????
        1008998c 7507 jnz 10089995
        1008998e 8b0e mov ecx,[esi] ds:00570300=00570720
        10089990 894f04 mov [edi+0x4],ecx ds:01455776=????????
        10089993 eb07 jmp 1008999c
        10089995 8b5604 mov edx,[esi+0x4] ds:0148ed06=????????
        10089998 8b06 mov eax,[esi] ds:00570300=00570720
FAULT ->1008999a 8902 mov [edx],eax ds:00000000=????????
        1008999c 8b06 mov eax,[esi] ds:00570300=00570720
        1008999e 85c0 test eax,eax
        100899a0 7406 jz 100899a8
        100899a2 8b4e04 mov ecx,[esi+0x4] ds:0148ed06=????????
        100899a5 894804 mov [eax+0x4],ecx ds:0148f126=????????
        100899a8 a1688c0f10 mov eax,[100f8c68] ds:100f8c68=00000000
        100899ad 85c0 test eax,eax
        100899af 745c jz 10089a0d
        100899b1 ffd0 call eax
        100899b3 5f pop edi
        100899b4 5e pop esi

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
00000004 00000000 00000000 00000000 00000000 00000000 <nosymbols>

*----> Raw Stack Dump <----*
0012fe7c a4 99 53 00 10 03 57 00 - 5f 9d 08 10 10 03 57 00 ..S...W._.....W.
0012fe8c 34 42 02 78 54 13 54 00 - bc fe 12 00 01 00 00 00 4B.xT.T.........
0012fe9c 33 27 00 10 00 00 00 00 - 00 00 00 00 20 00 54 00 3'.......... .T.
0012feac c0 17 54 00 20 00 54 00 - f0 32 54 00 20 12 54 00 ..T. .T..2T. .T.
0012febc 4c ff 12 00 bf 1a 40 00 - 00 00 00 00 00 00 00 00 L..... <email protected>
0012fecc 00 00 00 00 00 f0 fd 7f - 00 00 00 00 00 00 00 00 ................
0012fedc 04 00 00 00 00 00 00 00 - 00 cd 00 78 e8 3c 13 00 ...........x.<..
0012feec 40 ce 03 78 00 f0 fd 7f - 1d 00 00 00 90 02 54 00  <email protected>
0012fefc 34 ff 12 00 03 6f f6 77 - 60 04 57 00 00 00 00 00 4....o.w`.W.....
0012ff0c 30 03 57 00 00 ff ff ff - 00 00 00 00 01 00 00 00 0.W.............
0012ff1c 00 00 00 00 01 00 00 00 - 90 02 54 00 00 f0 fd 7f ..........T.....
0012ff2c 00 00 00 00 20 00 54 00 - 20 12 54 00 f0 32 54 00 .... .T. .T..2T.
0012ff3c 01 00 00 00 00 00 00 00 - 00 00 00 00 c0 17 54 00 ..............T.
0012ff4c c0 ff 12 00 cb 20 40 00 - 01 00 00 00 90 02 54 00 .....  <email protected>
0012ff5c 90 0c 54 00 00 40 40 00 - 04 40 40 00 a4 ff 12 00 ..T..@ <email protected>@ <email protected>
0012ff6c 94 ff 12 00 a0 ff 12 00 - 00 00 00 00 98 ff 12 00 ................
0012ff7c 08 40 40 00 0c 40 40 00 - 00 00 00 00 00 00 00 00 .@ <email protected>@ <email protected>
0012ff8c 00 f0 fd 7f 05 00 00 c0 - 90 02 54 00 00 00 00 00 ..........T.....
0012ff9c a1 c2 11 80 90 0c 54 00 - 01 00 00 00 84 ff 12 00 ......T.........
0012ffac c4 fc 12 00 e0 ff 12 00 - 20 21 40 00 50 31 40 00 ........ ! <email protected> <email protected>

State Dump for Thread Id 0xd5

eax=00007530 ebx=00000000 ecx=000000d7 edx=00000000 esi=77e726e5 edi=00c5ff6c
eip=77e72397 esp=00c5ff24 ebp=00c5ff48 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246

function: InvalidateRect
        77e7237e b89e110000 mov eax,0x119e
        77e72383 8d542404 lea edx,[esp+0x4] ss:01b7e92b=????????
        77e72387 cd2e int 2e
        77e72389 c20c00 ret 0xc
        77e7238c b885110000 mov eax,0x1185
        77e72391 8d542404 lea edx,[esp+0x4] ss:01b7e92b=????????
        77e72395 cd2e int 2e
        77e72397 c21400 ret 0x14

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
00c5ff48 10093e95 00c5ff6c 00000000 00000000 00000000 user32!InvalidateRect

*/
?>

---------------------------------------------------------------------------

The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online.

ATTENTION! Do NOT reply to this email!
To reply, use the web interface found at http://bugs.php.net/?id=11218&edit=2 

-- 
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, e-mail: php-dev-unsubscribe <email protected>
For additional commands, e-mail: php-dev-help <email protected>
To contact the list administrators, e-mail: php-list-admin <email protected>