Fix GH-21999: GC inconsistency after lazy object properties ht is added to roots - #22013
Merged
Merged
Conversation
arnaud-lb
changed the title
arnaud-lb
marked this pull request as ready for review
May 12, 2026 08:45
ndossche
approved these changes
Sep 20, 2026
* up/PHP-8.4: (338 commits) Fix phpGH-23693: JIT guard branches on stale flags across basic blocks Fix OSS-Fuzz #546798343: Heap-buffer-overflow in zend_delete_call_instructions with callable conversion Fix three Win32-only defects in proc_open descriptor handling Fix heap over-read in cli_get_prompt() for empty cli.prompt Fix phpGH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during request activation) Fix phpGH-23729: DOMXPath::__construct() use-after-free during an evaluation ext/zip: ZipArchive::close() use-after-free from a progress or cancel callback. ext/xsl: XSLTProcessor::importStylesheet() use-after-free during a transformation. ext/sockets: socket_select() silent set truncation on Windows. dom: fix attribute namespaces from foreign content in the HTML parser ext/sqlite3: reject close() from inside a callback ext/pdo: Bound-check column index in getColumnMeta() Fix phpGH-23365: DOMNode::insertBefore() drops the node used as its own reference Revert Zend: Fix iterator relocation at the current element during rehash in 8.4 and 8.5 Updated to version 2026.4 (2026d) [skip ci] lexbor: Reference upstream commits as lexbor/lexbor@<sha> in NEWS lexbor: Merge upstream memory safety fixes 8a14bc0 and f67ce4b Avoid closing libxml output encoder twice (php#23678) ext/intl: Preserve PHP-side state when cloning formatters Fix phpGH-23106: mb_strpos() overreads truncated UTF-8 haystacks (php#23107) ...
LamentXU123
pushed a commit
to LamentXU123/php-src
that referenced
this pull request
Sep 21, 2026
* PHP-8.4: Fix phpGH-21999: GC inconsistency after lazy object properties ht is added to roots (php#22013)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes GH-21999.
In the reproducer, a series of events causes a lazy object's properties ht to be a GC root [1]. The lazy object's
get_gc()handler however doesn't return the properties ht in this case, but still exposes properties to the GC. This causes properties to be visited twice.[1]:
var_dump($obj)builds the object's properties ht,zend_compare_symbol_tables()adds it to GC roots.