inheritance problem

[judas_iscariote]

Hi the following code produces wrong results and segfaults.

<?php

abstract class Foo {

protected function & a (){}

abstract function & b ();

}

class Bar extends Foo {

 protected function &a(){}

 public function &b()
 {
     $retval =& $this->a();
 }

}

$bar = new Bar();
$bar->b();
?>

• Expected result :

Notice: Only variable references should be returned by reference in /srv/www/htdocs/bug2.php on line 13 Notice: Only variable references should be returned by reference in /srv/www/htdocs/bug2.php on line 18

• Actual result :

at the first call : see expected result.

at the second call : Fatal error: Call to protected method Bar::a() from context 'Bar' in bug.php on line 17 and the apache child segfaults :(

[moo]

ripped reproducable source:

<?php

error_reporting(E_ALL);

class Foo {
    protected function a() { echo "foo::a()"; }
}

class Bar extends Foo {

    protected function a() { echo "bar::a()"; }

    public function b()
    {
        $this->a();
    }
}

$bar = new Bar();
$bar->b();

?>

Temp Patch pending

utils.c

@@ -305 +305 @@
        CG(zend_lineno) = ZESW(0, cep->line_start);
        zend_error(E_ERROR, "Cannot redeclare class %s", (char *) cep->name);
    }
+   if (cep->parent) {
+       zend_do_inheritance(cep, cep->parent);
+   }
    ZESW(return (xc_cest_t *) stored_ce_ptr, NOTHING);
 }
 /* }}} */

processor/processor.m4

@@ -488 +488 @@
        PROC_CLASS_ENTRY_P(scope)
    ')
    DISPATCH(zend_uint, fn_flags)
-   /* useless */
-   COPY(prototype)
+   COPYNULL(prototype)
    STRUCT_ARRAY_I(num_args, zend_arg_info, arg_info)
    DISPATCH(zend_uint, num_args)
    DISPATCH(zend_uint, required_num_args)

can u pls try the patch? i can't commit yet, as the svn is moving and marked readonly.

[judas_iscariote]

that worked Moo.. thank you ¡¡ ;-)

[judas_iscariote]

reopened because it causes side effects.

[moo]

here's the new patch, pls revert the patch above

$ svn di utils.c processor/processor.m4
(make sure there's no other changed made by yourself)
$ svn revert utils.c processor/processor.m4

readable patch:

processor/processor.m4

@@ -362 +362 @@
    COPY(handle_property_get)
    COPY(handle_property_set)
 #endif
-   dnl must after SETNULL(constructor)
+   dnl must do after SETNULL(constructor) and dst->parent
    STRUCT(HashTable, function_table, HashTable_zend_function)
    IFRESTORE(`dst->function_table.pDestructor = (dtor_func_t) destroy_zend_function;')
 ')
@@ -488 +488 @@
        PROC_CLASS_ENTRY_P(scope)
    ')
    DISPATCH(zend_uint, fn_flags)
-   /* useless */
-   COPY(prototype)
+   dnl mark it as -1 on store, and lookup parent on restore
+   IFSTORE(`dst->prototype = src->prototype ? (zend_function *) -1 : NULL; DONE(prototype)', `
+           IFRESTORE(`do {
+               zend_function *parent;
+               if (src->prototype != NULL
+                && zend_u_hash_find(&(processor->active_class_entry_dst->parent->function_table),
+                       UG(unicode) ? IS_UNICODE : IS_STRING,
+                       src->function_name, strlen(src->function_name) + 1,
+                       (void **) &parent) == SUCCESS) {
+                   /* see do_inherit_method_check() */
+                   if ((parent->common.fn_flags & ZEND_ACC_ABSTRACT)) {
+                     dst->prototype = parent;
+                   }
+                   else {
+                       dst->prototype = parent->common.prototype;
+                   }
+               }
+               else {
+                   dst->prototype = NULL;
+               }
+               DONE(prototype)
+           } while (0);
+           ', `
+               COPYNULL(prototype)
+           ')
+   ')
    STRUCT_ARRAY_I(num_args, zend_arg_info, arg_info)
    DISPATCH(zend_uint, num_args)
    DISPATCH(zend_uint, required_num_args)

copy-able patch:

Index: processor/processor.m4
===================================================================
--- processor/processor.m4  (revision 88)
+++ processor/processor.m4  (working copy)
@@ -362,7 +362,7 @@
    COPY(handle_property_get)
    COPY(handle_property_set)
 #endif
-   dnl must after SETNULL(constructor)
+   dnl must do after SETNULL(constructor) and dst->parent
    STRUCT(HashTable, function_table, HashTable_zend_function)
    IFRESTORE(`dst->function_table.pDestructor = (dtor_func_t) destroy_zend_function;')
 ')
@@ -488,8 +488,32 @@
        PROC_CLASS_ENTRY_P(scope)
    ')
    DISPATCH(zend_uint, fn_flags)
-   /* useless */
-   COPY(prototype)
+   dnl mark it as -1 on store, and lookup parent on restore
+   IFSTORE(`dst->prototype = src->prototype ? (zend_function *) -1 : NULL; DONE(prototype)', `
+           IFRESTORE(`do {
+               zend_function *parent;
+               if (src->prototype != NULL
+                && zend_u_hash_find(&(processor->active_class_entry_dst->parent->function_table),
+                       UG(unicode) ? IS_UNICODE : IS_STRING,
+                       src->function_name, strlen(src->function_name) + 1,
+                       (void **) &parent) == SUCCESS) {
+                   /* see do_inherit_method_check() */
+                   if ((parent->common.fn_flags & ZEND_ACC_ABSTRACT)) {
+                     dst->prototype = parent;
+                   }
+                   else {
+                       dst->prototype = parent->common.prototype;
+                   }
+               }
+               else {
+                   dst->prototype = NULL;
+               }
+               DONE(prototype)
+           } while (0);
+           ', `
+               COPYNULL(prototype)
+           ')
+   ')
    STRUCT_ARRAY_I(num_args, zend_arg_info, arg_info)
    DISPATCH(zend_uint, num_args)
    DISPATCH(zend_uint, required_num_args)

pls test it as i don't have time to install those big butt oop php-apps, feel free to reopen. thanks

gotta get svn+ssh account from Jan.. :P

[judas_iscariote]

test still segafaults with read only protection OFF.

[moo]

commited in [89]

[judas_iscariote]

in fact this and the "nasty toString issue" still segafaults, but only with read only protection OFF. :P

[moo]

in [89], and the segfalt was fixed in [94]