Segmentation fault in RecursiveIteratorIterator->current() with a xml element input

[YuanchengJiang]

Description

The following code:

<?php
$sx1 = new SimpleXMLElement("<root />");
$fusion = $sx1;
$test = new RecursiveIteratorIterator($fusion);
var_dump($test->current());

Resulted in this output:

/php-src/main/spprintf.c:376:14: runtime error: member access within null pointer of type 'zend_string' (aka 'struct _zend_string')

To reproduce: JIT 1015

PHP Version

nightly

Operating System

ubuntu 22.04

[ndossche]

It already goes wrong in non-JIT mode:

Fatal error: RecursiveIteratorIterator::current(): Return value must be of type mixed, null returned in Unknown on line 0

So the mixed type check for null isn't working properly apparently. But only for internal functions, userland functions seem fine... EDIT: actually on a release build it outputs "UNKNOWN:0" so that means an UNDEF value is produced somewhere and propagated...

[ndossche]

This is not a JIT nor opcache issue, the SXE iterator returns UNDEF when invalid (which is right EDIT: hmm or not will need to check) but SPL does not handle this right. Either it should check for validity first or check if the return value is UNDEF.

[ndossche]

Okay judging how the other code works: the issue is that SXE returns UNDEF but it should return NULL; that's how others do it too. So this is an SXE bug after all.