Skip to content

Segfault with array_multisort + array_shift (packed arrays?) #9244

Description

@chschneider

Description

The following code:

<?php
$items = ['foo' => 1, 'bar' => 2];
$order = [4, 3];
array_multisort($order, $items);
var_dump(array_shift($items));

Resulted in this output:

Segmentation fault (core dumped)

But I expected this output instead:

int(2)

After bisecting the relevant commit seems to be

commit 90b7bde61507cee1c6b37f153909d72f5b203b8c
Author: Dmitry Stogov <dmitry@zend.com>
Date:   Wed Nov 3 15:18:26 2021 +0300

    Use more compact representation for packed arrays.
    
    - for packed arrays we store just an array of zvals without keys.
    - the elements of packed array are accessible throuf as ht->arPacked[i]
      instead of ht->arData[i]
    - in addition to general ZEND_HASH_FOREACH_* macros, we introduced similar
      familied for packed (ZEND_HASH_PACKED_FORECH_*) and real hashes
      (ZEND_HASH_MAP_FOREACH_*)
    - introduced an additional family of macros to access elements of array
      (packed or real hashes) ZEND_ARRAY_ELEMET_SIZE, ZEND_ARRAY_ELEMET_EX,
      ZEND_ARRAY_ELEMET, ZEND_ARRAY_NEXT_ELEMENT, ZEND_ARRAY_PREV_ELEMENT
    - zend_hash_minmax() prototype was changed to compare only values
    
    Because of smaller data set, this patch may show performance improvement
    on some apps and benchmarks that use packed arrays. (~1% on PHP-Parser)
    
    TODO:
        - sapi/phpdbg needs special support for packed arrays (WATCH_ON_BUCKET).
        - zend_hash_sort_ex() may require converting packed arrays to hash. 

This commit is too complex for me to come up with a fix. But the last TODO mentioned in the commit message could be an indication of what is going wrong.

PHP Version

PHP 8.2.0-dev

Operating System

openSUSE Leap 15.3

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions