Segmentation fault Zend/zend_hash.h:1629

[YuanchengJiang]

Description

The following code:

<?php
class A {
public $prop = 41;
}
class B extends A {
public $prop = 42 {
get {
}
}
}
$b = new B();
var_dump($b);
$fusion = $b;
$inputs =  array (
@$fusion,
);
foreach($inputs as $input) {
var_dump(json_encode($input));
}

Resulted in this output:

object(B)#1 (1) {
  ["prop"]=>
  int(42)
}
Zend/zend_hash.h:1629:20: runtime error: member access within misaligned address 0x0000000000b1 for type 'zend_string' (aka 'struct _zend_string'), which requires 8 byte alignment
0x0000000000b1: note: pointer points here
<memory cannot be printed>
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior Zend/zend_hash.h:1629:20

PHP Version

nightly

Operating System

No response

[cmb69]

Slightly simplified reproducer:

<?php
class A {
    public $prop = 41;
}
class B extends A {
    public $prop = 42 {
        get {
        }
    }
}
$b = new B();
var_dump($b);
json_encode($b);

Looks like both var_dump() and json_encode() are required to trigger this.

Seems to be related to property hooks, so maybe @iluuu1994 will have a look.

[iluuu1994]

Good grief, how does this code still have bugs 😭 I'll have a look.