zif_get_object_vars: Assertion `!(((__ht)->u.flags & (1<<2)) != 0)' failed.

[Deltik]

Description

The following code:

<?php

$xmlData = <<<EOF
<?xml version="1.0" encoding="utf-8"?>
<document>https://github.com/php/php-src/issues/10200 not encountered</document>
EOF;

$xml = simplexml_load_string($xmlData);
$output = get_object_vars($xml);
var_dump($output);

Resulted in this output:

php: /tmp/php-build/source/8.2.0/Zend/zend_builtin_functions.c:763: zif_get_object_vars: Assertion `!(((__ht)->u.flags & (1<<2)) != 0)' failed.
Aborted

But I expected this output instead:

array(1) {
  [0] =>
  string(59) "https://github.com/php/php-src/issues/10200 not encountered"
}

This bug affects PHP 8.2.0 but not PHP 8.1.13.

PHP 8.2.0 was compiled with the following configure options:

--enable-sockets
--enable-exif
--with-zlib
--with-zlib-dir=/usr
--with-bz2
--enable-intl
--with-openssl
--enable-soap
--enable-xmlreader
--with-xsl
--enable-ftp
--enable-cgi
--with-curl=/usr
--with-tidy
--enable-sysvsem
--enable-sysvshm
--enable-shmop
--with-mysqli=mysqlnd
--with-pdo-mysql=mysqlnd
--with-pdo-sqlite
--enable-pcntl
--with-readline
--enable-mbstring
--enable-debug
--enable-fpm
--enable-bcmath
--enable-phpdbg
--with-webp
--enable-gd
--with-jpeg
--with-zip
--with-mhash

PHP Version

PHP 8.2.0

Operating System

Ubuntu 22.04

Additional Information

Here's the line in the PHP source code where the assertion error happens:
https://github.com/php/php-src/blob/PHP-8.2.0/Zend/zend_builtin_functions.c#L763

[nielsdos]

I analyzed this issue for a bit. I can confirm this happens on 8.2 and higher.

The issue occurs because the summary element does not have attributes in your example, so the array of properties is just

array(1) {
  [0]=>
  string(31) "Segmentation fault happens here"
}

i.e. there is only an integer index here, so it's a packed hash table. But the code at that line 763 assumes it gets a non-packed hash table. Replacing ZEND_HASH_MAP_FOREACH_KEY_VAL by ZEND_HASH_FOREACH_KEY_VAL fixes the issue in this case I think. The error and the ZEND_HASH_MAP_FOREACH_KEY_VAL macro were introduced by 90b7bde, so I guess the assumption that there's a non-packed hash table does not hold at all the places where this replacement happened.

Applying the following diff fixes this particular case, but there are probably more places where the following change needs to happen.

diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
index 8813fa9788..5cebbbc560 100644
--- a/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@ -760,7 +760,7 @@ ZEND_FUNCTION(get_object_vars)
        } else {
                array_init_size(return_value, zend_hash_num_elements(properties));
 
-               ZEND_HASH_MAP_FOREACH_KEY_VAL(properties, num_key, key, value) {
+               ZEND_HASH_FOREACH_KEY_VAL(properties, num_key, key, value) {
                        bool is_dynamic = 1;
                        if (Z_TYPE_P(value) == IS_INDIRECT) {
                                value = Z_INDIRECT_P(value);

[Deltik]

I updated my repro snippet with a much simpler one.