In _menu_sort(), we use two menu references which are incorrect. This code can cause segfaults in certain situations (in either core-only installations or with contrib modules installed - see here, here, and here). Historically, this appears to be an attempt at reference counting. Chx says "since PHP 4, PHP does not copy values ... just creates a reference and only in case one of the variables changes, it does copy. forcing a reference unless needed is totally pointless". The attached patch removes these pointless references.

CommentFileSizeAuthor
_menu_inc_reference.patch593 bytesmorbus iff

Comments

morbus iff’s picture

Title: _menu_sort erroneously uses references; can cause segfault » _menu_sort erroneously uses references; segfaults
chx’s picture

Title: _menu_sort erroneously uses references; segfaults » _menu_sort erroneously uses references; can cause segfault
Priority: Normal » Critical
Status: Needs review » Reviewed & tested by the community

Why it is pointless? Because we are not changing either $a nor $menu['items'][$a]. "Historically, this appears to be an attempt at reference counting." -- sorry this is not nonsense, because reference counting is the PHP mechanism I described above. The intention was propably to avoid copying of menu items here, however exactly because of reference counting (what I already described above) such copying will not happen (thanks god we do not deal with objects). If Drupal in its early days ran on PHP 3 then this piece was correct. Not any more.

If it can cause segfaults then it is a critical.

Steven’s picture

Status: Reviewed & tested by the community » Needs review

It looks like now, we are making a copy of both menu items... couldn't we just use $menu['items'][$a] directly? Is PHP smart enough to optimize this?

I'd like to see some simple benchmarking at least

Steven’s picture

Status: Needs review » Fixed

Ok, chx convinced me on IRC that this is optimal.

Committed to HEAD.

Anonymous’s picture

Status: Fixed » Closed (fixed)
jsenich’s picture

Is it safe to use this patch on 4.6.x and 4.7.x?

morbus iff’s picture

jsenich: yes.