3v4l.org

run code in 300+ PHP versions simultaneously
<?php error_reporting(E_ALL & ~E_DEPRECATED); // test serialize() functionality on shutdown register_shutdown_function('shutdown_serialize_test'); function shutdown_serialize_test() { $bug_test = new stdClass(); $bug_test_serialized = serialize([$bug_test, $bug_test]); $bug_test_unserialized = unserialize($bug_test_serialized); if ($bug_test_unserialized === false) { echo "\nserialize() / unserialize() round trip failed on shutdown\n"; } $reference_serialized = 'a:2:{i:0;O:8:"stdClass":0:{}i:1;r:2;}'; if ($bug_test_serialized !== $reference_serialized) { echo "serialize() on shutdown does not match reference:\n"; echo "$bug_test_serialized\n"; echo "should be:\n"; echo "$reference_serialized\n"; } } // records $test into trace function crash_step_1($test) { crash_step_2(debug_backtrace()); } // works on the first trace and serializes it, which triggers the second trace function crash_step_2($trace1) { $new_trace = []; foreach ($trace1 as $traceline) { if (isset($traceline['args'])) { $new_args = []; foreach ($traceline['args'] as $traceline_arg) { $new_args[] = $traceline_arg; } $traceline['args'] = $new_args; // this fails as well # $traceline['args'] = $traceline['args']; } $new_trace[] = $traceline; } return serialize($new_trace); } class class_crash_step_3 { protected function trace2() { $trace2 = debug_backtrace(); $var_list = []; foreach ($trace2 as $traceline) { if (!isset($traceline['args'])) continue; foreach ($traceline['args'] as $tracearg) { $var_idx = false; foreach ($var_list as $found_idx => $var_list_item) { // eventually, this comparison triggers the Fatal error if ($var_list_item === $tracearg) { $var_idx = $found_idx; break; } } if ($var_idx === false) { $var_list[] = $tracearg; } } } } } // this one triggers "Fatal error: Nesting level too deep - recursive dependency?" // and corrupts serialize() during shutdown, also affecting session handlers class class_crash_step_3_variant_A extends class_crash_step_3 implements Serializable { public function serialize() { $this->trace2(); } public function unserialize($data) { } } // interface Serializable is deprecated. with magic methods, corruption does not occur, // but "Fatal error: Nesting level too deep - recursive dependency?" is still triggered class class_crash_step_3_variant_B extends class_crash_step_3 { public function __serialize() { $this->trace2(); } public function __unserialize($data) { } } $test = new class_crash_step_3_variant_A(); #$test = new class_crash_step_3_variant_B(); crash_step_1($test); echo "End of script";
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/9qWTh
function name:  (null)
number of ops:  15
compiled vars:  !0 = $test
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    3     0  E >   INIT_FCALL                                               'error_reporting'
          1        SEND_VAL                                                 24575
          2        DO_ICALL                                                 
    6     3        INIT_FCALL                                               'register_shutdown_function'
          4        SEND_VAL                                                 'shutdown_serialize_test'
          5        DO_ICALL                                                 
   76     6        DECLARE_CLASS                                            'class_crash_step_3_variant_a', 'class_crash_step_3'
   92     7        NEW                                              $3      'class_crash_step_3_variant_A'
          8        DO_FCALL                                      0          
          9        ASSIGN                                                   !0, $3
   94    10        INIT_FCALL                                               'crash_step_1'
         11        SEND_VAR                                                 !0
         12        DO_FCALL                                      0          
   95    13        ECHO                                                     'End+of+script'
         14      > RETURN                                                   1

Function shutdown_serialize_test:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 15, Position 2 = 16
Branch analysis from position: 15
2 jumps found. (Code = 43) Position 1 = 19, Position 2 = 27
Branch analysis from position: 19
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 27
Branch analysis from position: 16
filename:       /in/9qWTh
function name:  shutdown_serialize_test
number of ops:  28
compiled vars:  !0 = $bug_test, !1 = $bug_test_serialized, !2 = $bug_test_unserialized, !3 = $reference_serialized
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    8     0  E >   NEW                                              $4      'stdClass'
          1        DO_FCALL                                      0          
          2        ASSIGN                                                   !0, $4
    9     3        INIT_FCALL                                               'serialize'
          4        INIT_ARRAY                                       ~7      !0
          5        ADD_ARRAY_ELEMENT                                ~7      !0
          6        SEND_VAL                                                 ~7
          7        DO_ICALL                                         $8      
          8        ASSIGN                                                   !1, $8
   10     9        INIT_FCALL                                               'unserialize'
         10        SEND_VAR                                                 !1
         11        DO_ICALL                                         $10     
         12        ASSIGN                                                   !2, $10
   11    13        TYPE_CHECK                                    4          !2
         14      > JMPZ                                                     ~12, ->16
   12    15    >   ECHO                                                     '%0Aserialize%28%29+%2F+unserialize%28%29+round+trip+failed+on+shutdown%0A'
   15    16    >   ASSIGN                                                   !3, 'a%3A2%3A%7Bi%3A0%3BO%3A8%3A%22stdClass%22%3A0%3A%7B%7Di%3A1%3Br%3A2%3B%7D'
   16    17        IS_NOT_IDENTICAL                                         !1, !3
         18      > JMPZ                                                     ~14, ->27
   17    19    >   ECHO                                                     'serialize%28%29+on+shutdown+does+not+match+reference%3A%0A'
   18    20        NOP                                                      
         21        FAST_CONCAT                                      ~15     !1, '%0A'
         22        ECHO                                                     ~15
   19    23        ECHO                                                     'should+be%3A%0A'
   20    24        NOP                                                      
         25        FAST_CONCAT                                      ~16     !3, '%0A'
         26        ECHO                                                     ~16
   23    27    > > RETURN                                                   null

End of function shutdown_serialize_test

Function crash_step_1:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/9qWTh
function name:  crash_step_1
number of ops:  7
compiled vars:  !0 = $test
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   26     0  E >   RECV                                             !0      
   27     1        INIT_FCALL_BY_NAME                                       'crash_step_2'
          2        INIT_FCALL                                               'debug_backtrace'
          3        DO_ICALL                                         $1      
          4        SEND_VAR_NO_REF_EX                                       $1
          5        DO_FCALL                                      0          
   28     6      > RETURN                                                   null

End of function crash_step_1

Function crash_step_2:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 77) Position 1 = 3, Position 2 = 19
Branch analysis from position: 3
2 jumps found. (Code = 78) Position 1 = 4, Position 2 = 19
Branch analysis from position: 4
2 jumps found. (Code = 43) Position 1 = 6, Position 2 = 16
Branch analysis from position: 6
2 jumps found. (Code = 77) Position 1 = 9, Position 2 = 13
Branch analysis from position: 9
2 jumps found. (Code = 78) Position 1 = 10, Position 2 = 13
Branch analysis from position: 10
1 jumps found. (Code = 42) Position 1 = 9
Branch analysis from position: 9
Branch analysis from position: 13
1 jumps found. (Code = 42) Position 1 = 3
Branch analysis from position: 3
Branch analysis from position: 13
Branch analysis from position: 16
Branch analysis from position: 19
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 19
filename:       /in/9qWTh
function name:  crash_step_2
number of ops:  25
compiled vars:  !0 = $trace1, !1 = $new_trace, !2 = $traceline, !3 = $new_args, !4 = $traceline_arg
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   31     0  E >   RECV                                             !0      
   32     1        ASSIGN                                                   !1, <array>
   33     2      > FE_RESET_R                                       $6      !0, ->19
          3    > > FE_FETCH_R                                               $6, !2, ->19
   34     4    >   ISSET_ISEMPTY_DIM_OBJ                         0          !2, 'args'
          5      > JMPZ                                                     ~7, ->16
   35     6    >   ASSIGN                                                   !3, <array>
   36     7        FETCH_DIM_R                                      ~9      !2, 'args'
          8      > FE_RESET_R                                       $10     ~9, ->13
          9    > > FE_FETCH_R                                               $10, !4, ->13
   37    10    >   ASSIGN_DIM                                               !3
         11        OP_DATA                                                  !4
   36    12      > JMP                                                      ->9
         13    >   FE_FREE                                                  $10
   39    14        ASSIGN_DIM                                               !2, 'args'
         15        OP_DATA                                                  !3
   43    16    >   ASSIGN_DIM                                               !1
         17        OP_DATA                                                  !2
   33    18      > JMP                                                      ->3
         19    >   FE_FREE                                                  $6
   46    20        INIT_FCALL                                               'serialize'
         21        SEND_VAR                                                 !1
         22        DO_ICALL                                         $14     
         23      > RETURN                                                   $14
   47    24*     > RETURN                                                   null

End of function crash_step_2

Class class_crash_step_3:
Function trace2:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 77) Position 1 = 5, Position 2 = 30
Branch analysis from position: 5
2 jumps found. (Code = 78) Position 1 = 6, Position 2 = 30
Branch analysis from position: 6
2 jumps found. (Code = 43) Position 1 = 9, Position 2 = 10
Branch analysis from position: 9
1 jumps found. (Code = 42) Position 1 = 5
Branch analysis from position: 5
Branch analysis from position: 10
2 jumps found. (Code = 77) Position 1 = 12, Position 2 = 28
Branch analysis from position: 12
2 jumps found. (Code = 78) Position 1 = 13, Position 2 = 28
Branch analysis from position: 13
2 jumps found. (Code = 77) Position 1 = 15, Position 2 = 22
Branch analysis from position: 15
2 jumps found. (Code = 78) Position 1 = 16, Position 2 = 22
Branch analysis from position: 16
2 jumps found. (Code = 43) Position 1 = 19, Position 2 = 21
Branch analysis from position: 19
1 jumps found. (Code = 42) Position 1 = 22
Branch analysis from position: 22
2 jumps found. (Code = 43) Position 1 = 25, Position 2 = 27
Branch analysis from position: 25
1 jumps found. (Code = 42) Position 1 = 12
Branch analysis from position: 12
Branch analysis from position: 27
Branch analysis from position: 21
1 jumps found. (Code = 42) Position 1 = 15
Branch analysis from position: 15
Branch analysis from position: 22
Branch analysis from position: 22
Branch analysis from position: 28
1 jumps found. (Code = 42) Position 1 = 5
Branch analysis from position: 5
Branch analysis from position: 28
Branch analysis from position: 30
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 30
filename:       /in/9qWTh
function name:  trace2
number of ops:  32
compiled vars:  !0 = $trace2, !1 = $var_list, !2 = $traceline, !3 = $tracearg, !4 = $var_idx, !5 = $var_list_item, !6 = $found_idx
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   51     0  E >   INIT_FCALL                                               'debug_backtrace'
          1        DO_ICALL                                         $7      
          2        ASSIGN                                                   !0, $7
   53     3        ASSIGN                                                   !1, <array>
   54     4      > FE_RESET_R                                       $10     !0, ->30
          5    > > FE_FETCH_R                                               $10, !2, ->30
   55     6    >   ISSET_ISEMPTY_DIM_OBJ                         0  ~11     !2, 'args'
          7        BOOL_NOT                                         ~12     ~11
          8      > JMPZ                                                     ~12, ->10
          9    > > JMP                                                      ->5
   56    10    >   FETCH_DIM_R                                      ~13     !2, 'args'
         11      > FE_RESET_R                                       $14     ~13, ->28
         12    > > FE_FETCH_R                                               $14, !3, ->28
   57    13    >   ASSIGN                                                   !4, <false>
   58    14      > FE_RESET_R                                       $16     !1, ->22
         15    > > FE_FETCH_R                                       ~17     $16, !5, ->22
         16    >   ASSIGN                                                   !6, ~17
   60    17        IS_IDENTICAL                                             !5, !3
         18      > JMPZ                                                     ~19, ->21
   61    19    >   ASSIGN                                                   !4, !6
   62    20      > JMP                                                      ->22
   58    21    > > JMP                                                      ->15
         22    >   FE_FREE                                                  $16
   66    23        TYPE_CHECK                                    4          !4
         24      > JMPZ                                                     ~21, ->27
   67    25    >   ASSIGN_DIM                                               !1
         26        OP_DATA                                                  !3
   56    27    > > JMP                                                      ->12
         28    >   FE_FREE                                                  $14
   54    29      > JMP                                                      ->5
         30    >   FE_FREE                                                  $10
   71    31      > RETURN                                                   null

End of function trace2

End of class class_crash_step_3.

Class class_crash_step_3_variant_A:
Function serialize:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/9qWTh
function name:  serialize
number of ops:  3
compiled vars:  none
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   78     0  E >   INIT_METHOD_CALL                                         'trace2'
          1        DO_FCALL                                      0          
   79     2      > RETURN                                                   null

End of function serialize

Function unserialize:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/9qWTh
function name:  unserialize
number of ops:  2
compiled vars:  !0 = $data
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   80     0  E >   RECV                                             !0      
          1      > RETURN                                                   null

End of function unserialize

End of class class_crash_step_3_variant_A.

Class class_crash_step_3_variant_B:
Function __serialize:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/9qWTh
function name:  __serialize
number of ops:  3
compiled vars:  none
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   87     0  E >   INIT_METHOD_CALL                                         'trace2'
          1        DO_FCALL                                      0          
   88     2      > RETURN                                                   null

End of function __serialize

Function __unserialize:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/9qWTh
function name:  __unserialize
number of ops:  2
compiled vars:  !0 = $data
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   89     0  E >   RECV                                             !0      
          1      > RETURN                                                   null

End of function __unserialize

Function trace2:
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 77) Position 1 = 5, Position 2 = 30
Branch analysis from position: 5
2 jumps found. (Code = 78) Position 1 = 6, Position 2 = 30
Branch analysis from position: 6
2 jumps found. (Code = 43) Position 1 = 9, Position 2 = 10
Branch analysis from position: 9
1 jumps found. (Code = 42) Position 1 = 5
Branch analysis from position: 5
Branch analysis from position: 10
2 jumps found. (Code = 77) Position 1 = 12, Position 2 = 28
Branch analysis from position: 12
2 jumps found. (Code = 78) Position 1 = 13, Position 2 = 28
Branch analysis from position: 13
2 jumps found. (Code = 77) Position 1 = 15, Position 2 = 22
Branch analysis from position: 15
2 jumps found. (Code = 78) Position 1 = 16, Position 2 = 22
Branch analysis from position: 16
2 jumps found. (Code = 43) Position 1 = 19, Position 2 = 21
Branch analysis from position: 19
1 jumps found. (Code = 42) Position 1 = 22
Branch analysis from position: 22
2 jumps found. (Code = 43) Position 1 = 25, Position 2 = 27
Branch analysis from position: 25
1 jumps found. (Code = 42) Position 1 = 12
Branch analysis from position: 12
Branch analysis from position: 27
Branch analysis from position: 21
1 jumps found. (Code = 42) Position 1 = 15
Branch analysis from position: 15
Branch analysis from position: 22
Branch analysis from position: 22
Branch analysis from position: 28
1 jumps found. (Code = 42) Position 1 = 5
Branch analysis from position: 5
Branch analysis from position: 28
Branch analysis from position: 30
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 30
filename:       /in/9qWTh
function name:  trace2
number of ops:  32
compiled vars:  !0 = $trace2, !1 = $var_list, !2 = $traceline, !3 = $tracearg, !4 = $var_idx, !5 = $var_list_item, !6 = $found_idx
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
   51     0  E >   INIT_FCALL                                               'debug_backtrace'
          1        DO_ICALL                                         $7      
          2        ASSIGN                                                   !0, $7
   53     3        ASSIGN                                                   !1, <array>
   54     4      > FE_RESET_R                                       $10     !0, ->30
          5    > > FE_FETCH_R                                               $10, !2, ->30
   55     6    >   ISSET_ISEMPTY_DIM_OBJ                         0  ~11     !2, 'args'
          7        BOOL_NOT                                         ~12     ~11
          8      > JMPZ                                                     ~12, ->10
          9    > > JMP                                                      ->5
   56    10    >   FETCH_DIM_R                                      ~13     !2, 'args'
         11      > FE_RESET_R                                       $14     ~13, ->28
         12    > > FE_FETCH_R                                               $14, !3, ->28
   57    13    >   ASSIGN                                                   !4, <false>
   58    14      > FE_RESET_R                                       $16     !1, ->22
         15    > > FE_FETCH_R                                       ~17     $16, !5, ->22
         16    >   ASSIGN                                                   !6, ~17
   60    17        IS_IDENTICAL                                             !5, !3
         18      > JMPZ                                                     ~19, ->21
   61    19    >   ASSIGN                                                   !4, !6
   62    20      > JMP                                                      ->22
   58    21    > > JMP                                                      ->15
         22    >   FE_FREE                                                  $16
   66    23        TYPE_CHECK                                    4          !4
         24      > JMPZ                                                     ~21, ->27
   67    25    >   ASSIGN_DIM                                               !1
         26        OP_DATA                                                  !3
   56    27    > > JMP                                                      ->12
         28    >   FE_FREE                                                  $14
   54    29      > JMP                                                      ->5
         30    >   FE_FREE                                                  $10
   71    31      > RETURN                                                   null

End of function trace2

End of class class_crash_step_3_variant_B.

Generated using Vulcan Logic Dumper, using php 8.0.0

preferences:
142.18 ms | 1030 KiB | 19 Q