Php sdk 2.3.1 lookup and mutate value free bug

* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0x2)
  * frame #0: 0x0000000100d15f92 couchbase.so`mutate_in_builder_free_object [inlined] zval_delref_p at zend_types.h:838 [opt]
    frame #1: 0x0000000100d15f8f couchbase.so`mutate_in_builder_free_object(object=<unavailable>) at mutate_in_builder.c:861 [opt]
    frame #2: 0x00000001001ecddc php`zend_objects_store_del(object=0x0000000101866510) at zend_objects_API.c:178 [opt]
    frame #3: 0x00000001001e8269 php`zend_object_std_dtor [inlined] i_zval_ptr_dtor at zend_variables.h:48 [opt]
    frame #4: 0x00000001001e8222 php`zend_object_std_dtor(object=0x0000000101866460) at zend_objects.c:68 [opt]
    frame #5: 0x00000001001ecddc php`zend_objects_store_del(object=0x0000000101866460) at zend_objects_API.c:178 [opt]
    frame #6: 0x000000010024fb74 php`zend_leave_helper_SPEC at zend_execute.c:2072 [opt]
    frame #7: 0x000000010024fb2b php`zend_leave_helper_SPEC(execute_data=0x00000001018187e0) at zend_vm_execute.h:571 [opt]
    frame #8: 0x00000001001f3018 php`execute_ex(ex=0x00000001018187e0) at zend_vm_execute.h:432 [opt]
    frame #9: 0x000000010019c62b php`zend_call_function(fci=<unavailable>, fci_cache=<unavailable>) at zend_execute_API.c:846 [opt]
    frame #10: 0x00000001000e6dd4 php`zif_call_user_func_array(execute_data=<unavailable>, return_value=0x00007fff5fbfebe0) at basic_functions.c:4853 [opt]
    frame #11: 0x000000010022cc1e php`ZEND_DO_FCALL_BY_NAME_SPEC_RETVAL_UNUSED_HANDLER(execute_data=0x00000001018183d0) at zend_vm_execute.h:797 [opt]
    frame #12: 0x00000001001f3018 php`execute_ex(ex=0x00000001018183d0) at zend_vm_execute.h:432 [opt]
    frame #13: 0x00000001001f332b php`zend_execute(op_array=0x00000001018732a0, return_value=<unavailable>) at zend_vm_execute.h:474 [opt]
    frame #14: 0x00000001001adc65 php`zend_execute_scripts(type=8, retval=0x0000000000000000, file_count=3) at zend.c:1476 [opt]
    frame #15: 0x0000000100144999 php`php_execute_script(primary_file=<unavailable>) at main.c:2537 [opt]
    frame #16: 0x0000000100259879 php`do_cli(argc=<unavailable>, argv=<unavailable>) at php_cli.c:993 [opt]
    frame #17: 0x000000010025874f php`main(argc=<unavailable>, argv=0x00007fff5fbffaf8) at php_cli.c:1381 [opt]
    frame #18: 0x00007fff8fcde235 libdyld.dylib`start + 1
    frame #19: 0x00007fff8fcde235 libdyld.dylib`start + 1

this is fix patch.

./src/couchbase/lookup_in_builder.c:190
./src/couchbase/mutate_in_builder.c:861

– Z_DELREF_P(obj->bucket_zval);

++ if(Z_REFCOUNTED_P(obj->bucket_zval)){
++ Z_DELREF_P(obj->bucket_zval);
++}

Thank you for report

could you post output of

php --version

the bucket_zval should be always refcounted value, so probably it is a different problem, I’m just trying to reproduce the issue. so php version and your script will help

php version info:

PHP 7.1.3 (cli) (built: Apr  6 2017 12:21:58) ( NTS )
Copyright (c) 1997-2017 The PHP Group
Zend Engine v3.1.0, Copyright (c) 1998-2017 Zend Technologies

test.php file.

<?php
namespace dark9\cli;

abstract class Base
{
    protected static $couchbase;
    
    protected $id;

    public function __construct(int $id = 0)
    {
        $this->id=$id;
    }
    
    protected function couchbase():\Couchbase\Bucket
    {
        if(!isset(self::$couchbase))
        {
            $cluster = new \Couchbase\Cluster('0.0.0.0');
            self::$couchbase = $cluster->openBucket();
        }
        
        return self::$couchbase;
    }

    protected function makeKey():string
    {
        return $this->id;
    }
}

class Object extends Base
{
    protected $in;
    protected $out;
    
    public function __construct(int $id = 0)
    {
        parent::__construct($id);
        $this->in = $this->couchbase()->mutateIn($this->makeKey());
        $this->out = $this->couchbase()->lookupIn($this->makeKey());
    }
}

class IntObject extends Object
{
    public function counter(array $counterList):array
    {
        $needCheck = [];
        foreach($counterList as $key=>$value)
        {
            if($value < 0)
            {
                $this->out->get($key);
                $needCheck[]=$key;
            }
        }

        if(!empty($needCheck))
        {
            $out = $this->out->execute();
            
            if($out->error instanceof \Couchbase\Exception)
            {
                throw new \Exception('', 1);
            }
            
            foreach($out->value as $index=>$obj)
            {
                if($obj['code'] === 63 || $obj['value'] < -$counterList[$needCheck[$index]])
                {
                    throw new \Exception('', 2);
                }
            }
        }
        
        $counterIndex=[];
        foreach($counterList as $key=>$value)
        {
            $this->in->counter($key, $value);
            $counterIndex[]=$key;
        }
        
        $in = $this->in->execute();
        
        if($in->error instanceof \Couchbase\Exception)
        {
            throw new \Exception('', 3);
        }
        
        $result = [];
        foreach($in->value as $index=>$obj)
        {
            $result[$counterIndex[$index]]=$obj->value;
        }
        
        return $result;
    }
}

class User extends IntObject {}

$User = new User();
$User->counter([1=>-1, 2=>-2]);

this too.

<?php
namespace dark9\cli;
$couchbase = new \Couchbase\Cluster('0.0.0.0');
$bucket = $couchbase->openBucket();
$item=$bucket->mutateIn('item');
$item->counter(1, 1);
var_dump($item);

I’ve fixed this issue in http://review.couchbase.org/76389

Right now waiting for jenkins, and it will be available as snapshot build soon

thanks for your hotfix.

<?php
namespace dark9\cli;
$couchbase = new \Couchbase\Cluster('0.0.0.0');
$bucket = $couchbase->openBucket();
$item=$bucket->mutateIn('item');
$item->counter(1, 1);
var_dump($item); // this ok
var_dump($item->id); // null
var_dump($item->cas); // null
var_dump($item->specs); // null

this is also a bug?

there are no such properties defined, if you turn on the error reporting, you will see something like this

PHP Notice:  Undefined property: Couchbase\MutateInBuilder::$id in /tmp/test.php on line 8

Notice: Undefined property: Couchbase\MutateInBuilder::$id in /tmp/test.php on line 8
NULL
PHP Notice:  Undefined property: Couchbase\MutateInBuilder::$cas in /tmp/test.php on line 9

Notice: Undefined property: Couchbase\MutateInBuilder::$cas in /tmp/test.php on line 9
NULL
PHP Notice:  Undefined property: Couchbase\MutateInBuilder::$specs in /tmp/test.php on line 10

Notice: Undefined property: Couchbase\MutateInBuilder::$specs in /tmp/test.php on line 10
NULL

So this is not a bug, it just not in the API

under var_dump($this); output, id, cas, specs look like defined property.
the properties will in future API update?

This is just debug information with helps to check internal state of the object. It is just initialize new array with keys. The instance itself does not define the properties and stores everything in structs which more easy to use with libcouchbase.

Id, cas and specs are input parameters, and I don’t plan to allow to read them back once you assigned them.

What is the usecase for getting access to them?

got it.
thanks for your reply and happy birthday :birthday: