Uploaded image for project: 'PHP Driver: Extension'
  1. PHP Driver: Extension
  2. PHPC-239

refcount failure in cursor

    • Type: Icon: Bug Bug
    • Resolution: Done
    • Priority: Icon: Major - P3 Major - P3
    • 0.5.0
    • Affects Version/s: 0.4.1
    • Component/s: None
    • None

      <?php
      class Address implements BSON\Persistable {
          protected $streetAddress;
          protected $city;
          protected $postalCode;
      
          function __construct($streetAddress, $city, $postalCode) {
              $this->streetAddress = $streetAddress;
              $this->city          = $city;
              $this->postalCode    = $postalCode;
      
          }
          function bsonUnserialize(array $array) {
              foreach($array as $k => $v) {
                  $this->{$k} = $v;
              }
      
              return $this;
          }
      
          function bsonSerialize() {
              return get_object_vars($this);
          }
      }
      
      class Person implements BSON\Persistable {
          protected $_id;
          protected $username;
          protected $email;
          protected $name;
          protected $addresses = array();
      
          function __construct($username, $email, $name) {
              $this->username = $username;
              $this->email    = $email;
              $this->name     = $name;
      
              /* Pregenerate our ObjectID */
              $this->_id     = new BSON\ObjectID();
          }
          function addAddress(Address $address) {
              $this->addresses[] = $address;
          }
      
          function bsonUnserialize(array $array) {
              foreach($array as $k => $v) {
                  $this->{$k} = $v;
              }
          }
      
          function bsonSerialize() {
              return get_object_vars($this);
          }
      }
      
      
      $lair77 = new Person('lair77', 'claire77@example.net', 'Claire Corwin');
      $hillardhaven = new Address('4527 Kohler Square Apt. 316', 'Hillardhaven', '02622-5175');
      $lair77->addAddress($hillardhaven);
      $prudencemouth = new Address('7042 Freida Springs', 'Prudencemouth', '94805');
      $lair77->addAddress($prudencemouth);
      
      
      $tabitha = new Person('tabitha.mohr', 'mohr@example.org', 'Tabitha Lehner');
      $konopelskichester = new Address('76650 Mina Pass', 'Konopelskichester', '69679-5471');
      $tabitha->addAddress($konopelskichester);
      
      $hartmann = new Person('hartmann', 'hartmann@example.org', 'Hartmann Dedrick');
      $leannefurt = new Address('151 Delbert Hills Suite 923', 'Leannefurt', '22036');
      $hartmann->addAddress($leannefurt);
      
      $ena = new Person('ena', 'ena.sanford@example.net', 'Frida Sanford'); 
      $lawsonport = new Address('3656 Jenifer Field', 'New Lawsonport', '16300');
      $ena->addAddress($lawsonport);
      
      
      $lockman = new Person('cartwright.garland', 'lockman.olga@example.net', 'Alice Carter');
      $herminia = new Address('37413 Kailee Spurs', 'East Herminia', '22107');
      $lockman->addAddress($herminia);
      
      
      $dropcoll = new MongoDB\Driver\Command(array("drop" => "people"));
      $query = new MongoDB\Driver\Query(array());
      $queryHartmann = new MongoDB\Driver\Query(array("username" => "hartmann"));
      
      
      $bulk = new MongoDB\Driver\BulkWrite;
      $bulk->insert($lair77);
      $bulk->insert($tabitha);
      $bulk->insert($hartmann);
      $bulk->insert($ena);
      $bulk->insert($lockman);
      
      $m = new MongoDB\Driver\Manager("mongodb://localhost");
      try {
          $m->executeCommand("examples", $dropcoll);
      } catch(Exception $e) {}
      
      $m->executeBulkWrite("examples.people", $bulk);
      
      
      foreach($m->executeQuery("examples.people", $query) as $person) {
          var_dump($person);
      }
      
      echo "-----\n";
      foreach($m->executeQuery("examples.people", $queryHartmann) as $hartmann) {
          var_dump($hartmann);
      }
      
      (gdb) bt
      #0  0x00000000008272c0 in zval_delref_p (pz=0x5a5a5a5a5a5a5a5a) at /usr/local/p/src/5.6.2/Zend/zend.h:411
      #1  0x000000000082744c in i_zval_ptr_dtor (zval_ptr=0x5a5a5a5a5a5a5a5a, __zend_filename=0x7ffff591d220 "/tmp/pear/temp/mongodb/php_phongo.c", __zend_lineno=1541) at /usr/local/p/src/5.6.2/Zend/zend_execute.h:76
      #2  0x0000000000828788 in _zval_ptr_dtor (zval_ptr=0x7ffff7e11310, __zend_filename=0x7ffff591d220 "/tmp/pear/temp/mongodb/php_phongo.c", __zend_lineno=1541) at /usr/local/p/src/5.6.2/Zend/zend_execute_API.c:427
      #3  0x00007ffff590b036 in php_phongo_cursor_free_current (cursor=0x7ffff7e112d0) at /tmp/pear/temp/mongodb/php_phongo.c:1541
      #4  0x00007ffff590b11c in php_phongo_cursor_iterator_dtor (iter=0x7ffff7e11558) at /tmp/pear/temp/mongodb/php_phongo.c:1569
      #5  0x0000000000861560 in iter_wrapper_dtor (object=0x7ffff7e11558, handle=23) at /usr/local/p/src/5.6.2/Zend/zend_iterators.c:61
      #6  0x000000000087f3ee in zend_objects_store_del_ref_by_handle_ex (handle=23, handlers=0xfb9900 <iterator_object_handlers>) at /usr/local/p/src/5.6.2/Zend/zend_objects_API.c:212
      #7  0x000000000087f207 in zend_objects_store_del_ref (zobject=0x7ffff7e09708) at /usr/local/p/src/5.6.2/Zend/zend_objects_API.c:178
      #8  0x000000000083c559 in _zval_dtor_func (zvalue=0x7ffff7e09708, __zend_filename=0xca5ea8 "/usr/local/p/src/5.6.2/Zend/zend_execute.h", __zend_lineno=79) at /usr/local/p/src/5.6.2/Zend/zend_variables.c:57
      #9  0x00000000008811cb in _zval_dtor (zvalue=0x7ffff7e09708, __zend_filename=0xca5ea8 "/usr/local/p/src/5.6.2/Zend/zend_execute.h", __zend_lineno=79) at /usr/local/p/src/5.6.2/Zend/zend_variables.h:35
      #10 0x0000000000881292 in i_zval_ptr_dtor (zval_ptr=0x7ffff7e09708, __zend_filename=0xca6510 "/usr/local/p/src/5.6.2/Zend/zend_vm_execute.h", __zend_lineno=13518) at /usr/local/p/src/5.6.2/Zend/zend_execute.h:79
      #11 0x00000000008a63a2 in ZEND_SWITCH_FREE_SPEC_VAR_HANDLER (execute_data=0x7ffff7f94f48) at /usr/local/p/src/5.6.2/Zend/zend_vm_execute.h:13518
      #12 0x0000000000886b85 in execute_ex (execute_data=0x7ffff7f94f48) at /usr/local/p/src/5.6.2/Zend/zend_vm_execute.h:363
      #13 0x0000000000886c0e in zend_execute (op_array=0x7ffff7fcf8c0) at /usr/local/p/src/5.6.2/Zend/zend_vm_execute.h:388
      #14 0x0000000000840164 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /usr/local/p/src/5.6.2/Zend/zend.c:1344
      #15 0x00000000007a3c18 in php_execute_script (primary_file=0x7fffffffc880) at /usr/local/p/src/5.6.2/main/main.c:2584
      #16 0x00000000008fae58 in do_cli (argc=2, argv=0xfda8d0) at /usr/local/p/src/5.6.2/sapi/cli/php_cli.c:994
      #17 0x00000000008fc180 in main (argc=2, argv=0xfda8d0) at /usr/local/p/src/5.6.2/sapi/cli/php_cli.c:1378
      
      ==17208== Invalid read of size 8
      ==17208==    at 0x756C011: php_phongo_cursor_free_current (php_phongo.c:1540)
      ==17208==    by 0x756C11B: php_phongo_cursor_iterator_dtor (php_phongo.c:1569)
      ==17208==    by 0x86155F: iter_wrapper_dtor (zend_iterators.c:61)
      ==17208==    by 0x87F3ED: zend_objects_store_del_ref_by_handle_ex (zend_objects_API.c:212)
      ==17208==    by 0x87F206: zend_objects_store_del_ref (zend_objects_API.c:178)
      ==17208==    by 0x83C558: _zval_dtor_func (zend_variables.c:57)
      ==17208==    by 0x8811CA: _zval_dtor (zend_variables.h:35)
      ==17208==    by 0x881291: i_zval_ptr_dtor (zend_execute.h:79)
      ==17208==    by 0x8A63A1: ZEND_SWITCH_FREE_SPEC_VAR_HANDLER (zend_vm_execute.h:13518)
      ==17208==    by 0x886B84: execute_ex (zend_vm_execute.h:363)
      ==17208==    by 0x886C0D: zend_execute (zend_vm_execute.h:388)
      ==17208==    by 0x840163: zend_execute_scripts (zend.c:1344)
      ==17208==  Address 0x7fb9780 is 64 bytes inside a block of size 96 free'd
      ==17208==    at 0x4C2BE10: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
      ==17208==    by 0x804F25: _efree (zend_alloc.c:2437)
      ==17208==    by 0x74FFDAC: php_phongo_cursor_free_object (Cursor.c:206)
      ==17208==    by 0x87F510: zend_objects_store_del_ref_by_handle_ex (zend_objects_API.c:226)
      ==17208==    by 0x87F206: zend_objects_store_del_ref (zend_objects_API.c:178)
      ==17208==    by 0x83C558: _zval_dtor_func (zend_variables.c:57)
      ==17208==    by 0x8273F1: _zval_dtor (zend_variables.h:35)
      ==17208==    by 0x8274B8: i_zval_ptr_dtor (zend_execute.h:79)
      ==17208==    by 0x828787: _zval_ptr_dtor (zend_execute_API.c:427)
      ==17208==    by 0x756C100: php_phongo_cursor_iterator_dtor (php_phongo.c:1565)
      ==17208==    by 0x86155F: iter_wrapper_dtor (zend_iterators.c:61)
      ==17208==    by 0x87F3ED: zend_objects_store_del_ref_by_handle_ex (zend_objects_API.c:212)
      ==17208== 
      
      

            Assignee:
            bjori Hannes Magnusson
            Reporter:
            bjori Hannes Magnusson
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: