setTypeMap crash with PHP 7.1

[rinu]

Calling Cursor::setTypeMap crashes in some cases.
I posted more details here: https://bugs.php.net/bug.php?id=74073

---

Description:

A project I'm working on, recently started using MongoDB for some of it's storage. I can't share the entire project, the following is the smallest code example that reproduces the crash.

This is not an issue with the official Ubuntu PHP 7.0 packages. I have compiled PHP 7.1.1 and MongoDB extension myself.

I tried getting a core dump but couldn't figure it out. I have a debug build so it should be possible but I can't get it set up.

Steps to reproduce:

1. Use PHP 7.1.1
2. Install mongodb extension
3. Create composer.json with the following contents:

{
	"require" : {
	}
}

4. Run composer install
5. Save test script as test.php
6. Run php test.php

Test script:

<?php

require 'vendor/autoload.php';

$manager = new MongoDB\Driver\Manager("mongodb://localhost:27017");

$bulk = new MongoDB\Driver\BulkWrite;
$id = $bulk->insert(['x' => 1]);
$manager->executeBulkWrite('db.collection', $bulk);

$query = new MongoDB\Driver\Query(['_id' => $id]);
$cursor = $manager->executeQuery('db.collection', $query);
$cursor->setTypeMap([
	'array' => 'MongoDB\\Model\\BSONArray',
	'document' => 'MongoDB\\Model\\BSONDocument',
	'root' => 'MongoDB\\Model\\BSONDocument'
]);

Expected result:

Unhandled exception

Actual result:

php: /home/rauno/php7/include/php/Zend/zend_string.h:263: zend_string_free: Assertion `(s)->gc.refcount <= 1' failed.
Aborted (core dumped)

[jmikola]

I'm going to need a full backtrace to properly diagnose this.

Also, why is "Unhandled exception" the expected result? Based on the code provided, I would expect there to be no output and no exception.

[rinu]

(gdb) bt
#0  0x00007ffff4ecb428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
#1  0x00007ffff4ecd02a in __GI_abort () at abort.c:89
#2  0x00007ffff4ec3bd7 in __assert_fail_base (fmt=<optimized out>, assertion=assertion@entry=0x7fffe7e0acc8 "(s)->gc.refcount <= 1", file=file@entry=0x7fffe7e0ac98 "/home/rauno/php7/include/php/Zend/zend_string.h", 
    line=line@entry=263, function=function@entry=0x7fffe7e0b1c0 <__PRETTY_FUNCTION__.6856> "zend_string_free") at assert.c:92
#3  0x00007ffff4ec3c82 in __GI___assert_fail (assertion=0x7fffe7e0acc8 "(s)->gc.refcount <= 1", file=0x7fffe7e0ac98 "/home/rauno/php7/include/php/Zend/zend_string.h", line=263, 
    function=0x7fffe7e0b1c0 <__PRETTY_FUNCTION__.6856> "zend_string_free") at assert.c:101
#4  0x00007fffe7dd7be1 in zend_string_free (s=0x7fffed688cd0) at /home/rauno/php7/include/php/Zend/zend_string.h:263
#5  0x00007fffe7ddb22b in apply_classname_to_state (classname=0x7fffdcf807e0 "MongoDB\\Model\\BSONArray", classname_len=23, type=0x7fffffffa170, type_ce=0x7fffffffa178) at /home/rauno/mongo-php-driver/src/bson.c:1656
#6  0x00007fffe7ddb370 in phongo_bson_typemap_to_state (typemap=0x7fffed615140, map=0x7fffffffa160) at /home/rauno/mongo-php-driver/src/bson.c:1683
#7  0x00007fffe7de85ec in zim_Cursor_setTypeMap (execute_data=0x7fffed6150f0, return_value=0x7fffffffa260) at /home/rauno/mongo-php-driver/src/MongoDB/Cursor.c:230
#8  0x0000000000afea14 in execute_internal (execute_data=0x7fffed6150f0, return_value=0x7fffffffa260) at /home/rauno/php-src/Zend/zend_execute.c:2047
#9  0x00007fffecbd6de7 in xdebug_execute_internal (current_execute_data=0x7fffed6150f0, return_value=0x7fffffffa260) at /home/rauno/xdebug/xdebug.c:1858
#10 0x0000000000b02424 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER () at /home/rauno/php-src/Zend/zend_vm_execute.h:972
#11 0x0000000000b04f70 in ZEND_USER_OPCODE_SPEC_HANDLER () at /home/rauno/php-src/Zend/zend_vm_execute.h:1825
#12 0x0000000000b00d5d in execute_ex (ex=0x7fffed615030) at /home/rauno/php-src/Zend/zend_vm_execute.h:429
#13 0x00007fffecbd6823 in xdebug_execute_ex (execute_data=0x7fffed615030) at /home/rauno/xdebug/xdebug.c:1750
#14 0x0000000000b00e6e in zend_execute (op_array=0x7fffed68b000, return_value=0x0) at /home/rauno/php-src/Zend/zend_vm_execute.h:474
#15 0x0000000000a9e2f2 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at /home/rauno/php-src/Zend/zend.c:1475
#16 0x0000000000a053e9 in php_execute_script (primary_file=0x7fffffffc9f0) at /home/rauno/php-src/main/main.c:2537
#17 0x0000000000b87b8d in do_cli (argc=2, argv=0x14e8a80) at /home/rauno/php-src/sapi/cli/php_cli.c:993
#18 0x0000000000b88d60 in main (argc=2, argv=0x14e8a80) at /home/rauno/php-src/sapi/cli/php_cli.c:1381

[rinu]

The expected result of the test script is (got it with 7.0)
PHP Fatal error: Uncaught MongoDB\Driver\Exception\InvalidArgumentException: Class MongoDB\Model\BSONArray does not exist in test.php:14

[jmikola]

Thanks for the backtrace. I was able to diagnose the bug from that and opened PHPC-923 to track the issue.

[jmikola]

The fix is merged and should appear in the subsequent 1.2.6 release.

[rinu]

The issue is indeed fixed in v1.2 branch - my project started working with PHP 7.1 again.
Thank you.

[jmikola]

1.2.6 has been released.