Assertion ret == SUCCESS in array_map()/array_filter() after delayed out-of-memory

Description

The following code:

<?php
$s = str_repeat("a", 5 * 1024 * 1024);
$s .= $s;
array_map(fn($x) => $x, [1]);

Resulted in this output:

php: ext/standard/array.c:7122: void zif_array_map(zend_execute_data *, zval *): Assertion `ret == SUCCESS' failed.
Aborted (core dumped)

To reproduce: ./sapi/cli/php -d memory_limit=10M test.php

Commit:

33a61f765a94e018a8d55d962a73e8c8331ee256

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-pcre-jit --with-iconv

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

The same happens with array_filter([1], fn($x) => $x); instead of array_map() (Assertion 'result == SUCCESS' failed at ext/standard/array.c:6933).

This report is automatically generated by FlowFusion

PHP Version

nightly

Operating System

No response

@arnaud-lb

The comment in zend_call_function:

Callers expect SUCCESS || EG(exception), so let's throw right now

Is wrong. A long time ago the code was changed such that SUCCESS is always returned except when the executor is inactive. Callers depend on this.

This would fix it, but I'd like a second opinion of @arnaud-lb / @iluuu1994

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 4db42ddb741..57fe6f96227 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -836,9 +836,11 @@ zend_result zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_
 		return FAILURE; /* executor is already inactive */
 	}
 	if (ZEND_HAS_OOM()) {
-		/* Callers expect SUCCESS || EG(exception), so let's throw right now */
+		/* Throws UnwindExit if the OOM is pending. If not pending, acts as if executor is inactive. */
 		zend_handle_delayed_oom();
-		return FAILURE;
+		if (!EG(exception)) {
+			return FAILURE;
+		}
 	}
 	if (EG(exception)) {
 		if (fci_cache) {

Indeed we expect SUCCESS if an exception is thrown.

@ndossche

@ndossche Looks good. Previously it was possible for zend_handle_delayed_oom() to exit without setting EG(exception), namely via recursion in zend_error_zstr_at(). But we since refactored this code to call zend_throw_unwind_exit() early so that this shouldn't be possible anymore (recursion is still possible, but EG(exception) will already be set). We can keep the if for now just in case, and transform it to ZEND_ASSERT() in master.

Navigation Menu

Repository navigation

Assertion ret == SUCCESS in array_map()/array_filter() after delayed out-of-memory #25311

Description

PHP Version

Operating System

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Assertion ret == SUCCESS in array_map()/array_filter() after delayed out-of-memory #25311

Description

Description

PHP Version

Operating System

Activity

ndossche commented on Nov 9, 2026

Girgias commented on Nov 9, 2026

iluuu1994 commented on Nov 9, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions