php bug 68933

testsuite.php

<?php

class A {
	public static $a;

	public static function setup()
	{
		self::$a = new A;
	}

	public function __set($name, $value)
	{
		echo "__set($name)\n";
		$this->$name = $value;

		return $this;
	}

	public function __get($name)
	{
		$class = $name;

		if (!class_exists($name))
			$class = 'D';

		echo "__get($name)\n";

		if (!isset($this->$name))
			$this->initialize($name, $class);

		return $this->$name;
	}

	public function initialize($name, $class)
	{
		$value = new $class;
		$this->__set($name, $value);
		$value->init();
	}
}


class B
{
	public $c;
	public $name = 'B';

	public function init()
	{
		$this->c = A::$a->C;
	}
}


class C
{
	public function __construct()
	{
		//echo A::$a->B->name;
	}

	public function init()
	{
	}
}

class D extends C {}
class E extends C {}
class F extends C {}

A::setup();
var_dump(A::$a->D, A::$a->E, A::$a->F, A::$a->G, A::$a->H, A::$a->I, A::$a->J, A::$a->K, A::$a->L, A::$a->M, A::$a->N, A::$a->O, A::$a->P, 
A::$a->Q, A::$a->R);

A::$a->B;

valgrind output

[arjen@arjen-imac phpng]$ USE_ZEND_ALLOC=0 valgrind --track-origins=yes --leak-check=full php-src/sapi/cli/php test__get.php 
==22400== Memcheck, a memory error detector
==22400== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==22400== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
==22400== Command: php-src/sapi/cli/php test__get.php
==22400== 
__get(D)
__set(D)
__set(D)
__get(E)
__set(E)
__set(E)
__get(F)
__set(F)
__set(F)
__get(G)
__set(G)
__set(G)
__get(H)
__set(H)
__set(H)
__get(I)
__set(I)
__set(I)
__get(J)
__set(J)
__set(J)
__get(K)
__set(K)
__set(K)
__get(L)
__set(L)
__set(L)
__get(M)
__set(M)
__set(M)
__get(N)
__set(N)
__set(N)
__get(O)
__set(O)
__set(O)
__get(P)
__set(P)
__set(P)
__get(Q)
__set(Q)
__set(Q)
__get(R)
__set(R)
__set(R)
object(D)#2 (0) {
}
object(E)#3 (0) {
}
object(F)#4 (0) {
}
object(D)#5 (0) {
}
object(D)#6 (0) {
}
object(D)#7 (0) {
}
object(D)#8 (0) {
}
object(D)#9 (0) {
}
object(D)#10 (0) {
}
object(D)#11 (0) {
}
object(D)#12 (0) {
}
object(D)#13 (0) {
}
object(D)#14 (0) {
}
object(D)#15 (0) {
}
object(D)#16 (0) {
}
__get(B)
__set(B)
__set(B)
__get(C)
__set(C)
__set(C)
==22400== Invalid read of size 8
==22400==    at 0x97DA64: zend_std_read_property (zend_object_handlers.c:540)
==22400==    by 0x9ADDF4: ZEND_FETCH_OBJ_R_SPEC_VAR_CONST_HANDLER (zend_vm_execute.h:13108)
==22400==    by 0x98FFB4: execute_ex (zend_vm_execute.h:352)
==22400==    by 0x99010D: zend_execute (zend_vm_execute.h:381)
==22400==    by 0x942F09: zend_execute_scripts (zend.c:1271)
==22400==    by 0x8B9F58: php_execute_script (main.c:2554)
==22400==    by 0x9E63B8: do_cli (php_cli.c:982)
==22400==    by 0x9E7361: main (php_cli.c:1361)
==22400==  Address 0xc537220 is 480 bytes inside a block of size 576 free'd
==22400==    at 0x4C2C29E: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==22400==    by 0x913546: _erealloc (zend_alloc.c:2219)
==22400==    by 0x913741: _safe_erealloc (zend_alloc.c:2257)
==22400==    by 0x954DBE: zend_hash_do_resize (zend_hash.c:573)
==22400==    by 0x953BEB: _zend_hash_add_or_update_i (zend_hash.c:299)
==22400==    by 0x953E7C: _zend_hash_add_new (zend_hash.c:343)
==22400==    by 0x97D7C9: zend_get_property_guard (zend_object_handlers.c:490)
==22400==    by 0x97D9B8: zend_std_read_property (zend_object_handlers.c:532)
==22400==    by 0x9ADDF4: ZEND_FETCH_OBJ_R_SPEC_VAR_CONST_HANDLER (zend_vm_execute.h:13108)
==22400==    by 0x98FFB4: execute_ex (zend_vm_execute.h:352)
==22400==    by 0x92B956: zend_call_function (zend_execute_API.c:835)
==22400==    by 0x966AD0: zend_call_method (zend_interfaces.c:101)
==22400== 
==22400== Invalid write of size 8
==22400==    at 0x97DA72: zend_std_read_property (zend_object_handlers.c:540)
==22400==    by 0x9ADDF4: ZEND_FETCH_OBJ_R_SPEC_VAR_CONST_HANDLER (zend_vm_execute.h:13108)
==22400==    by 0x98FFB4: execute_ex (zend_vm_execute.h:352)
==22400==    by 0x99010D: zend_execute (zend_vm_execute.h:381)
==22400==    by 0x942F09: zend_execute_scripts (zend.c:1271)
==22400==    by 0x8B9F58: php_execute_script (main.c:2554)
==22400==    by 0x9E63B8: do_cli (php_cli.c:982)
==22400==    by 0x9E7361: main (php_cli.c:1361)
==22400==  Address 0xc537220 is 480 bytes inside a block of size 576 free'd
==22400==    at 0x4C2C29E: realloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==22400==    by 0x913546: _erealloc (zend_alloc.c:2219)
==22400==    by 0x913741: _safe_erealloc (zend_alloc.c:2257)
==22400==    by 0x954DBE: zend_hash_do_resize (zend_hash.c:573)
==22400==    by 0x953BEB: _zend_hash_add_or_update_i (zend_hash.c:299)
==22400==    by 0x953E7C: _zend_hash_add_new (zend_hash.c:343)
==22400==    by 0x97D7C9: zend_get_property_guard (zend_object_handlers.c:490)
==22400==    by 0x97D9B8: zend_std_read_property (zend_object_handlers.c:532)
==22400==    by 0x9ADDF4: ZEND_FETCH_OBJ_R_SPEC_VAR_CONST_HANDLER (zend_vm_execute.h:13108)
==22400==    by 0x98FFB4: execute_ex (zend_vm_execute.h:352)
==22400==    by 0x92B956: zend_call_function (zend_execute_API.c:835)
==22400==    by 0x966AD0: zend_call_method (zend_interfaces.c:101)
==22400== 
==22400== 
==22400== HEAP SUMMARY:
==22400==     in use at exit: 16,848 bytes in 5 blocks
==22400==   total heap usage: 28,092 allocs, 28,087 frees, 2,844,157 bytes allocated
==22400== 
==22400== LEAK SUMMARY:
==22400==    definitely lost: 0 bytes in 0 blocks
==22400==    indirectly lost: 0 bytes in 0 blocks
==22400==      possibly lost: 0 bytes in 0 blocks
==22400==    still reachable: 16,848 bytes in 5 blocks
==22400==         suppressed: 0 bytes in 0 blocks
==22400== Reachable blocks (those to which a pointer was found) are not shown.
==22400== To see them, rerun with: --leak-check=full --show-leak-kinds=all
==22400== 
==22400== For counts of detected and suppressed errors, rerun with: -v
==22400== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)