3v4l.org

run code in 500+ PHP versions simultaneously
<?php error_reporting(E_ALL & ~E_DEPRECATED); // test serialize() functionality on shutdown register_shutdown_function('shutdown_serialize_test'); function shutdown_serialize_test() { $bug_test = new stdClass(); $bug_test_serialized = serialize([$bug_test, $bug_test]); $bug_test_unserialized = unserialize($bug_test_serialized); if ($bug_test_unserialized === false) { echo "\nserialize() / unserialize() round trip failed on shutdown\n"; } $reference_serialized = 'a:2:{i:0;O:8:"stdClass":0:{}i:1;r:2;}'; if ($bug_test_serialized !== $reference_serialized) { echo "serialize() on shutdown does not match reference:\n"; echo "$bug_test_serialized\n"; echo "should be:\n"; echo "$reference_serialized\n"; } } // records $test into trace function crash_step_1($test) { crash_step_2(debug_backtrace()); } // works on the first trace and serializes it, which triggers the second trace function crash_step_2($trace1) { $new_trace = []; foreach ($trace1 as $traceline) { if (isset($traceline['args'])) { $new_args = []; foreach ($traceline['args'] as $traceline_arg) { $new_args[] = $traceline_arg; } $traceline['args'] = $new_args; // this fails as well # $traceline['args'] = $traceline['args']; } $new_trace[] = $traceline; } return serialize($new_trace); } class class_crash_step_3 { protected function trace2() { $trace2 = debug_backtrace(); $var_list = []; foreach ($trace2 as $traceline) { if (!isset($traceline['args'])) continue; foreach ($traceline['args'] as $tracearg) { $var_idx = false; foreach ($var_list as $found_idx => $var_list_item) { // eventually, this comparison triggers the Fatal error if ($var_list_item === $tracearg) { $var_idx = $found_idx; break; } } if ($var_idx === false) { $var_list[] = $tracearg; } } } } } // this one triggers "Fatal error: Nesting level too deep - recursive dependency?" // and corrupts serialize() during shutdown, also affecting session handlers class class_crash_step_3_variant_A extends class_crash_step_3 implements Serializable { public function serialize() { $this->trace2(); } public function unserialize($data) { } } // interface Serializable is deprecated. with magic methods, corruption does not occur, // but "Fatal error: Nesting level too deep - recursive dependency?" is still triggered class class_crash_step_3_variant_B extends class_crash_step_3 { public function __serialize() { $this->trace2(); } public function __unserialize($data) { } } $test = new class_crash_step_3_variant_A(); #$test = new class_crash_step_3_variant_B(); crash_step_1($test); echo "End of script";
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/9qWTh
function name:  (null)
number of ops:  15
compiled vars:  !0 = $test
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
    3     0  E >   INIT_FCALL                                                   'error_reporting'
          1        SEND_VAL                                                     22527
          2        DO_ICALL                                                     
    6     3        INIT_FCALL                                                   'register_shutdown_function'
          4        SEND_VAL                                                     'shutdown_serialize_test'
          5        DO_ICALL                                                     
   76     6        DECLARE_CLASS                                                'class_crash_step_3_variant_a', 'class_crash_step_3'
   92     7        NEW                                                  $3      'class_crash_step_3_variant_A'
          8        DO_FCALL                                          0          
          9        ASSIGN                                                       !0, $3
   94    10        INIT_FCALL                                                   'crash_step_1'
         11        SEND_VAR                                                     !0
         12        DO_FCALL                                          0          
   95    13        ECHO                                                         'End+of+script'
         14      > RETURN                                                       1

Function shutdown_serialize_test:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 15, Position 2 = 16
Branch analysis from position: 15
2 jumps found. (Code = 43) Position 1 = 19, Position 2 = 27
Branch analysis from position: 19
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 27
Branch analysis from position: 16
filename:       /in/9qWTh
function name:  shutdown_serialize_test
number of ops:  28
compiled vars:  !0 = $bug_test, !1 = $bug_test_serialized, !2 = $bug_test_unserialized, !3 = $reference_serialized
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
    8     0  E >   NEW                                                  $4      'stdClass'
          1        DO_FCALL                                          0          
          2        ASSIGN                                                       !0, $4
    9     3        INIT_FCALL                                                   'serialize'
          4        INIT_ARRAY                                           ~7      !0
          5        ADD_ARRAY_ELEMENT                                    ~7      !0
          6        SEND_VAL                                                     ~7
          7        DO_ICALL                                             $8      
          8        ASSIGN                                                       !1, $8
   10     9        INIT_FCALL                                                   'unserialize'
         10        SEND_VAR                                                     !1
         11        DO_ICALL                                             $10     
         12        ASSIGN                                                       !2, $10
   11    13        TYPE_CHECK                                        4          !2
         14      > JMPZ                                                         ~12, ->16
   12    15    >   ECHO                                                         '%0Aserialize%28%29+%2F+unserialize%28%29+round+trip+failed+on+shutdown%0A'
   15    16    >   ASSIGN                                                       !3, 'a%3A2%3A%7Bi%3A0%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7Di%3A1%3Br%3A2%3B%7D'
   16    17        IS_NOT_IDENTICAL                                             !1, !3
         18      > JMPZ                                                         ~14, ->27
   17    19    >   ECHO                                                         'serialize%28%29+on+shutdown+does+not+match+reference%3A%0A'
   18    20        NOP                                                          
         21        FAST_CONCAT                                          ~15     !1, '%0A'
         22        ECHO                                                         ~15
   19    23        ECHO                                                         'should+be%3A%0A'
   20    24        NOP                                                          
         25        FAST_CONCAT                                          ~16     !3, '%0A'
         26        ECHO                                                         ~16
   23    27    > > RETURN                                                       null

End of function shutdown_serialize_test

Function crash_step_1:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/9qWTh
function name:  crash_step_1
number of ops:  7
compiled vars:  !0 = $test
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   26     0  E >   RECV                                                 !0      
   27     1        INIT_FCALL_BY_NAME                                           'crash_step_2'
          2        INIT_FCALL                                                   'debug_backtrace'
          3        DO_ICALL                                             $1      
          4        SEND_VAR_NO_REF_EX                                           $1
          5        DO_FCALL                                          0          
   28     6      > RETURN                                                       null

End of function crash_step_1

Function crash_step_2:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 77) Position 1 = 3, Position 2 = 19
Branch analysis from position: 3
2 jumps found. (Code = 78) Position 1 = 4, Position 2 = 19
Branch analysis from position: 4
2 jumps found. (Code = 43) Position 1 = 6, Position 2 = 16
Branch analysis from position: 6
2 jumps found. (Code = 77) Position 1 = 9, Position 2 = 13
Branch analysis from position: 9
2 jumps found. (Code = 78) Position 1 = 10, Position 2 = 13
Branch analysis from position: 10
1 jumps found. (Code = 42) Position 1 = 9
Branch analysis from position: 9
Branch analysis from position: 13
1 jumps found. (Code = 42) Position 1 = 3
Branch analysis from position: 3
Branch analysis from position: 13
Branch analysis from position: 16
Branch analysis from position: 19
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 19
filename:       /in/9qWTh
function name:  crash_step_2
number of ops:  25
compiled vars:  !0 = $trace1, !1 = $new_trace, !2 = $traceline, !3 = $new_args, !4 = $traceline_arg
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   31     0  E >   RECV                                                 !0      
   32     1        ASSIGN                                                       !1, <array>
   33     2      > FE_RESET_R                                           $6      !0, ->19
          3    > > FE_FETCH_R                                                   $6, !2, ->19
   34     4    >   ISSET_ISEMPTY_DIM_OBJ                             0          !2, 'args'
          5      > JMPZ                                                         ~7, ->16
   35     6    >   ASSIGN                                                       !3, <array>
   36     7        FETCH_DIM_R                                          ~9      !2, 'args'
          8      > FE_RESET_R                                           $10     ~9, ->13
          9    > > FE_FETCH_R                                                   $10, !4, ->13
   37    10    >   ASSIGN_DIM                                                   !3
         11        OP_DATA                                                      !4
   36    12      > JMP                                                          ->9
         13    >   FE_FREE                                                      $10
   39    14        ASSIGN_DIM                                                   !2, 'args'
         15        OP_DATA                                                      !3
   43    16    >   ASSIGN_DIM                                                   !1
         17        OP_DATA                                                      !2
   33    18      > JMP                                                          ->3
         19    >   FE_FREE                                                      $6
   46    20        INIT_FCALL                                                   'serialize'
         21        SEND_VAR                                                     !1
         22        DO_ICALL                                             $14     
         23      > RETURN                                                       $14
   47    24*     > RETURN                                                       null

End of function crash_step_2

Class class_crash_step_3:
Function trace2:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 77) Position 1 = 5, Position 2 = 30
Branch analysis from position: 5
2 jumps found. (Code = 78) Position 1 = 6, Position 2 = 30
Branch analysis from position: 6
2 jumps found. (Code = 43) Position 1 = 9, Position 2 = 10
Branch analysis from position: 9
1 jumps found. (Code = 42) Position 1 = 5
Branch analysis from position: 5
Branch analysis from position: 10
2 jumps found. (Code = 77) Position 1 = 12, Position 2 = 28
Branch analysis from position: 12
2 jumps found. (Code = 78) Position 1 = 13, Position 2 = 28
Branch analysis from position: 13
2 jumps found. (Code = 77) Position 1 = 15, Position 2 = 22
Branch analysis from position: 15
2 jumps found. (Code = 78) Position 1 = 16, Position 2 = 22
Branch analysis from position: 16
2 jumps found. (Code = 43) Position 1 = 19, Position 2 = 21
Branch analysis from position: 19
1 jumps found. (Code = 42) Position 1 = 22
Branch analysis from position: 22
2 jumps found. (Code = 43) Position 1 = 25, Position 2 = 27
Branch analysis from position: 25
1 jumps found. (Code = 42) Position 1 = 12
Branch analysis from position: 12
Branch analysis from position: 27
Branch analysis from position: 21
1 jumps found. (Code = 42) Position 1 = 15
Branch analysis from position: 15
Branch analysis from position: 22
Branch analysis from position: 22
Branch analysis from position: 28
1 jumps found. (Code = 42) Position 1 = 5
Branch analysis from position: 5
Branch analysis from position: 28
Branch analysis from position: 30
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 30
filename:       /in/9qWTh
function name:  trace2
number of ops:  32
compiled vars:  !0 = $trace2, !1 = $var_list, !2 = $traceline, !3 = $tracearg, !4 = $var_idx, !5 = $var_list_item, !6 = $found_idx
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   51     0  E >   INIT_FCALL                                                   'debug_backtrace'
          1        DO_ICALL                                             $7      
          2        ASSIGN                                                       !0, $7
   53     3        ASSIGN                                                       !1, <array>
   54     4      > FE_RESET_R                                           $10     !0, ->30
          5    > > FE_FETCH_R                                                   $10, !2, ->30
   55     6    >   ISSET_ISEMPTY_DIM_OBJ                             0  ~11     !2, 'args'
          7        BOOL_NOT                                             ~12     ~11
          8      > JMPZ                                                         ~12, ->10
          9    > > JMP                                                          ->5
   56    10    >   FETCH_DIM_R                                          ~13     !2, 'args'
         11      > FE_RESET_R                                           $14     ~13, ->28
         12    > > FE_FETCH_R                                                   $14, !3, ->28
   57    13    >   ASSIGN                                                       !4, <false>
   58    14      > FE_RESET_R                                           $16     !1, ->22
         15    > > FE_FETCH_R                                           ~17     $16, !5, ->22
         16    >   ASSIGN                                                       !6, ~17
   60    17        IS_IDENTICAL                                                 !5, !3
         18      > JMPZ                                                         ~19, ->21
   61    19    >   ASSIGN                                                       !4, !6
   62    20      > JMP                                                          ->22
   58    21    > > JMP                                                          ->15
         22    >   FE_FREE                                                      $16
   66    23        TYPE_CHECK                                        4          !4
         24      > JMPZ                                                         ~21, ->27
   67    25    >   ASSIGN_DIM                                                   !1
         26        OP_DATA                                                      !3
   56    27    > > JMP                                                          ->12
         28    >   FE_FREE                                                      $14
   54    29      > JMP                                                          ->5
         30    >   FE_FREE                                                      $10
   71    31      > RETURN                                                       null

End of function trace2

End of class class_crash_step_3.

Class class_crash_step_3_variant_A:
Function serialize:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/9qWTh
function name:  serialize
number of ops:  3
compiled vars:  none
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   78     0  E >   INIT_METHOD_CALL                                             'trace2'
          1        DO_FCALL                                          0          
   79     2      > RETURN                                                       null

End of function serialize

Function unserialize:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/9qWTh
function name:  unserialize
number of ops:  2
compiled vars:  !0 = $data
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   80     0  E >   RECV                                                 !0      
          1      > RETURN                                                       null

End of function unserialize

End of class class_crash_step_3_variant_A.

Class class_crash_step_3_variant_B:
Function __serialize:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/9qWTh
function name:  __serialize
number of ops:  3
compiled vars:  none
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   87     0  E >   INIT_METHOD_CALL                                             'trace2'
          1        DO_FCALL                                          0          
   88     2      > RETURN                                                       null

End of function __serialize

Function __unserialize:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/9qWTh
function name:  __unserialize
number of ops:  2
compiled vars:  !0 = $data
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   89     0  E >   RECV                                                 !0      
          1      > RETURN                                                       null

End of function __unserialize

Function trace2:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 77) Position 1 = 5, Position 2 = 30
Branch analysis from position: 5
2 jumps found. (Code = 78) Position 1 = 6, Position 2 = 30
Branch analysis from position: 6
2 jumps found. (Code = 43) Position 1 = 9, Position 2 = 10
Branch analysis from position: 9
1 jumps found. (Code = 42) Position 1 = 5
Branch analysis from position: 5
Branch analysis from position: 10
2 jumps found. (Code = 77) Position 1 = 12, Position 2 = 28
Branch analysis from position: 12
2 jumps found. (Code = 78) Position 1 = 13, Position 2 = 28
Branch analysis from position: 13
2 jumps found. (Code = 77) Position 1 = 15, Position 2 = 22
Branch analysis from position: 15
2 jumps found. (Code = 78) Position 1 = 16, Position 2 = 22
Branch analysis from position: 16
2 jumps found. (Code = 43) Position 1 = 19, Position 2 = 21
Branch analysis from position: 19
1 jumps found. (Code = 42) Position 1 = 22
Branch analysis from position: 22
2 jumps found. (Code = 43) Position 1 = 25, Position 2 = 27
Branch analysis from position: 25
1 jumps found. (Code = 42) Position 1 = 12
Branch analysis from position: 12
Branch analysis from position: 27
Branch analysis from position: 21
1 jumps found. (Code = 42) Position 1 = 15
Branch analysis from position: 15
Branch analysis from position: 22
Branch analysis from position: 22
Branch analysis from position: 28
1 jumps found. (Code = 42) Position 1 = 5
Branch analysis from position: 5
Branch analysis from position: 28
Branch analysis from position: 30
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 30
filename:       /in/9qWTh
function name:  trace2
number of ops:  32
compiled vars:  !0 = $trace2, !1 = $var_list, !2 = $traceline, !3 = $tracearg, !4 = $var_idx, !5 = $var_list_item, !6 = $found_idx
line      #* E I O op                               fetch          ext  return  operands
-----------------------------------------------------------------------------------------
   51     0  E >   INIT_FCALL                                                   'debug_backtrace'
          1        DO_ICALL                                             $7      
          2        ASSIGN                                                       !0, $7
   53     3        ASSIGN                                                       !1, <array>
   54     4      > FE_RESET_R                                           $10     !0, ->30
          5    > > FE_FETCH_R                                                   $10, !2, ->30
   55     6    >   ISSET_ISEMPTY_DIM_OBJ                             0  ~11     !2, 'args'
          7        BOOL_NOT                                             ~12     ~11
          8      > JMPZ                                                         ~12, ->10
          9    > > JMP                                                          ->5
   56    10    >   FETCH_DIM_R                                          ~13     !2, 'args'
         11      > FE_RESET_R                                           $14     ~13, ->28
         12    > > FE_FETCH_R                                                   $14, !3, ->28
   57    13    >   ASSIGN                                                       !4, <false>
   58    14      > FE_RESET_R                                           $16     !1, ->22
         15    > > FE_FETCH_R                                           ~17     $16, !5, ->22
         16    >   ASSIGN                                                       !6, ~17
   60    17        IS_IDENTICAL                                                 !5, !3
         18      > JMPZ                                                         ~19, ->21
   61    19    >   ASSIGN                                                       !4, !6
   62    20      > JMP                                                          ->22
   58    21    > > JMP                                                          ->15
         22    >   FE_FREE                                                      $16
   66    23        TYPE_CHECK                                        4          !4
         24      > JMPZ                                                         ~21, ->27
   67    25    >   ASSIGN_DIM                                                   !1
         26        OP_DATA                                                      !3
   56    27    > > JMP                                                          ->12
         28    >   FE_FREE                                                      $14
   54    29      > JMP                                                          ->5
         30    >   FE_FREE                                                      $10
   71    31      > RETURN                                                       null

End of function trace2

End of class class_crash_step_3_variant_B.

Generated using Vulcan Logic Dumper, using php 8.5.0


preferences:
158.93 ms | 1427 KiB | 19 Q