Uh oh!
There was an error while loading. Please reload this page.
Bug #63581 Possible null dereference and buffer overflow - #234
Closed
remicollet wants to merge 2 commits into
Closed
Bug #63581 Possible null dereference and buffer overflow#234remicollet wants to merge 2 commits into
remicollet wants to merge 2 commits into
Conversation
remicollet
commented
Nov 28, 2012
MemberAuthor
Applied |
EdmondDantes added a commit
to true-async/php-src
that referenced
this pull request
Aug 18, 2026
Three review findings, in the order they cost the most. The adjustment moved out of gc_possible_root_when_full, a function upstream edits and the fork had so far kept byte-identical; the call site now names a fork-only wrapper and nothing else in that function changes. Reweaving upstream control flow at every merge was a worse price than the redundant call the restructure had saved. The record is replayed only when the run examined something. A collection that finds the root buffer already drained returns 0 without looking at a root, and adjusting on that 0 stepped the threshold up for free - the same ratchet the commit before this one removed, reached through a different door. A spawn that fails now clears the record instead of leaving it for a coroutine that was never created. The dispose hook is gone with them: extended_dispose does not fire on every path that destroys a coroutine, so it was insurance that only looked complete, and the per-request clear in gc_reset() covers the case it was added for.
EdmondDantes added a commit
to true-async/php-src
that referenced
this pull request
Aug 18, 2026
The clear on spawn failure could not fire: gc_collect_cycles() runs first and clears the record, then the wrapper two frames up re-evaluates the same predicate, finds it still true and sets it back. The record was therefore always left behind by a failed spawn, and the clear only ever reached explicit collections, where it could drop a pending record instead. The wrapper now records only while a coroutine actually owes the run. No coroutine means the collection either ran inline or was never spawned, and in both cases the count in hand is the honest one - which also stops a genuine count from being discarded when async activates inside a destructor of an inline run.
EdmondDantes added a commit
to true-async/php-src
that referenced
this pull request
Aug 18, 2026
php#234: adjust the GC threshold from the coroutine that collects
EdmondDantes added a commit
to true-async/php-src
that referenced
this pull request
Aug 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See https://bugs.php.net/63581