reproducable segfault when recursing

[birdspider]

Description

The following code:

<?php
class X
{
  public function method4()
  {
    $a = function (){ $this->method4(); }; // I know this makes no sense
    array_map($a,[1]);
  }
}

(new X)->method4();

Resulted in this output:

$ php test.php 
Speicherzugriffsfehler (Speicherabzug geschrieben) # segfault

But I expected this output instead:

# not a segfault

https://3v4l.org/AajsP

---

bt:

#0  0x000055555591d1ae in zend_create_closure_ex (res=0x7fffe5ec1380, func=0x7ffff4e03ac0, scope=0x7ffff4e03300, called_scope=0x7ffff4e03300, this_ptr=0x7fffe5ec1340, is_fake=false) at /usr/src/debug/php/php-8.1.13/Zend/zend_closures.c:677
#1  0x00005555558c3edf in zend_create_closure (this_ptr=<optimized out>, called_scope=<optimized out>, scope=<optimized out>, func=<optimized out>, res=<optimized out>) at /usr/src/debug/php/php-8.1.13/Zend/zend_closures.c:780
#2  ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_CONST_HANDLER (execute_data=0x7fffe5ec1320) at /usr/src/debug/php/php-8.1.13/Zend/zend_vm_execute.h:5359
#3  0x0000555555905388 in execute_ex (ex=<optimized out>) at /usr/src/debug/php/php-8.1.13/Zend/zend_vm_execute.h:55581
#4  0x0000555555886c3c in zend_call_function (fci=<optimized out>, fci_cache=<optimized out>) at /usr/src/debug/php/php-8.1.13/Zend/zend_execute_API.c:908
#5  0x000055555578d212 in zif_array_map (execute_data=<optimized out>, return_value=0x7fffff7ff280) at /usr/src/debug/php/php-8.1.13/ext/standard/array.c:5955
#6  0x00005555558c0360 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER (execute_data=0x7fffe5ec11a0) at /usr/src/debug/php/php-8.1.13/Zend/zend_vm_execute.h:1235
#7  0x0000555555905388 in execute_ex (ex=<optimized out>) at /usr/src/debug/php/php-8.1.13/Zend/zend_vm_execute.h:55581
#8  0x0000555555886c3c in zend_call_function (fci=<optimized out>, fci_cache=<optimized out>) at /usr/src/debug/php/php-8.1.13/Zend/zend_execute_API.c:908

[snip 53000 lines]

#53652 0x0000555555886c3c in zend_call_function (fci=<optimized out>, fci_cache=<optimized out>) at /usr/src/debug/php/php-8.1.13/Zend/zend_execute_API.c:908
#53653 0x000055555578d212 in zif_array_map (execute_data=<optimized out>, return_value=0x7fffffffa640) at /usr/src/debug/php/php-8.1.13/ext/standard/array.c:5955
#53654 0x00005555558c0360 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER (execute_data=0x7ffff4e13220) at /usr/src/debug/php/php-8.1.13/Zend/zend_vm_execute.h:1235
#53655 0x0000555555905388 in execute_ex (ex=<optimized out>) at /usr/src/debug/php/php-8.1.13/Zend/zend_vm_execute.h:55581
#53656 0x0000555555886c3c in zend_call_function (fci=<optimized out>, fci_cache=<optimized out>) at /usr/src/debug/php/php-8.1.13/Zend/zend_execute_API.c:908
#53657 0x000055555578d212 in zif_array_map (execute_data=<optimized out>, return_value=0x7fffffffa8b0) at /usr/src/debug/php/php-8.1.13/ext/standard/array.c:5955
#53658 0x00005555558c0360 in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER (execute_data=0x7ffff4e130a0) at /usr/src/debug/php/php-8.1.13/Zend/zend_vm_execute.h:1235
#53659 0x0000555555905388 in execute_ex (ex=<optimized out>) at /usr/src/debug/php/php-8.1.13/Zend/zend_vm_execute.h:55581
#53660 0x000055555590b2dc in zend_execute (op_array=0x7ffff4e8b000, return_value=0x0) at /usr/src/debug/php/php-8.1.13/Zend/zend_vm_execute.h:60147
#53661 0x0000555555896445 in zend_execute (return_value=0x0, op_array=0x7ffff4e8b000) at /usr/src/debug/php/php-8.1.13/Zend/zend.c:1785
#53662 zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/src/debug/php/php-8.1.13/Zend/zend.c:1799
#53663 0x000055555582e655 in php_execute_script (primary_file=<optimized out>) at /usr/src/debug/php/php-8.1.13/main/main.c:2541
#53664 0x000055555597f034 in do_cli (argc=2, argv=0x555556636fd0) at /usr/src/debug/php/php-8.1.13/sapi/cli/php_cli.c:965
#53665 0x0000555555641f12 in main (argc=2, argv=0x555556636fd0) at /usr/src/debug/php/php-8.1.13/sapi/cli/php_cli.c:1367

PHP Version

PHP 8.1.13

Operating System

Archlinux

[birdspider]

this also happens when using "Arrow Functions" $a = fn () => $this->method4();

[arnaud-lb]

This is the result of overflowing the native call stack.

#9104 is an attempt to make this more user friendly.

[cmb69]

Note, though, that this is documented behavior:

Recursive function/method calls with over 100-200 recursion levels can smash the stack and cause a termination of the current script. Especially, infinite recursion is considered a programming error.

[birdspider]

Since I was simply reporting what I thought was a bug (brought about via typo/programming error), but it is documented behavior and work is on the way to address the feedback, I'll close this.