Assertion failure at zend_fiber_suspend_internal

[YuanchengJiang]

Description

The following code:

<?php
try {
$fiber = new Fiber(function() use ($gen, &$fiber) {
});
$fiber = new Fiber(function (): int {
$test = new _ZendTestFiber(function (): void {
$value = Fiber::suspend(1);
});
var_dump($test->start()); // NULL
});
$value = $fiber->start();
} catch (\Throwable $_ffl_e) {}

Resulted in this output:

php: /home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/Zend/zend_fibers.c:701: zend_fiber_transfer zend_fiber_suspend_internal(zend_fiber *, zval *): Assertion `fiber->caller != ((void*)0)' failed.
Aborted (core dumped)

To reproduce:

/home/fuzz/WorkSpace/fusion-fuzz/projects/php/php-src/sapi/cli/php  ./test.php

Commit:

fd8eaaf153f958c66068e3bc71b950ee33cb56e8

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

This bug was found by fusion-fuzz

PHP Version

nightly

Operating System

No response

[iliaal]

A Fiber suspended from inside a _ZendTestFiber ends up with fiber->previous pointing at the test fiber's context, because zend_fiber_suspend_internal sets previous to the currently running EG(current_fiber_context), which is the test fiber, not the Fiber's own context. That's fine while both are alive; fiber_test_01 resumes back through it. The crash is a teardown-order issue: the discarded first Fiber in the repro perturbs GC so the _ZendTestFiber gets destroyed first, its context goes DEAD, and then zend_fiber_object_destroy resumes the suspended Fiber into that dead context, hitting the switch_context assertion. Drop the first Fiber and the order is benign, no crash. The fiber->caller != NULL assertion in the report is the same bug at an older commit.

Two fixes I ruled out. Rejecting Fiber::suspend() from a foreign coroutine breaks fiber_test_01/03/04, since that nesting is intended. Skipping the unwind-resume when previous is DEAD stops the crash but leaks the suspended Fiber's vm_stack and frames (16 KB under ASAN), because its continuation lived on the test fiber's stack and there's nothing left to unwind into once that's gone.

So it looks like it needs an ownership or ordering rule: a fiber suspended within a foreign coroutine has to keep that coroutine alive until the fiber itself is destroyed, so the destruction order can't invert. But the core only has the bare zend_fiber_context pointer for the foreign side, with no handle on its owning object. Should the core enforce that, or is _ZendTestFiber expected to coordinate its own teardown here?

[devnexen]

see #16496 and #17898.