Everything

php

big reference bug in (at least) PHP 5.0.5

php.internals

Ron Korving

20 years ago

My apologies for my DOM-mistake today, but right now I came across something
that totally stunned me. It's a total paradox situation that just has to be
one of the biggest bugs I've ever come across in PHP. Personally, I think
it's rather high-priority because it's an engine problem, and not an issue
with some extension.

Here's the code:

<?php
$array = array();

for ($i=0; $i < 3; $i++)
$array[] = array("foo" => $i);

foreach ($array as &$item)
$item["bar"] = $item["foo"] * 2;

print_r($array);

foreach ($array as $item)
print_r($item);
?>

The expected result would be to see whatever is in the array twice. Once in
the big print_r() on $array, and once per element of $array.

Here's the actual result (look at the last array element):

Array
(
[0] => Array
(
[foo] => 0
[bar] => 0
)

[1] => Array
(
[foo] => 1
[bar] => 2
)

[2] => Array
(
[foo] => 2
[bar] => 4
)

)
Array
(
[foo] => 0
[bar] => 0
)
Array
(
[foo] => 1
[bar] => 2
)
Array
(
[foo] => 1
[bar] => 2
)

So referencing wih foreach() is obviously buggy.
With this foreach it works just fine:

foreach ($array as $i => $item)
$array[$i]["bar"] = $item["foo"] * 2;


I fear this bug is not just present in PHP 5.0.5, but in older versions too.

Ron Korving

Antony Dovgal

20 years ago

On 16.09.2005 16:29, Ron Korving wrote:

> My apologies for my DOM-mistake today, but right now I came across something
> that totally stunned me. It's a total paradox situation that just has to be
> one of the biggest bugs I've ever come across in PHP. Personally, I think
> it's rather high-priority because it's an engine problem, and not an issue
> with some extension.
>
> Here's the code:
>
> <?php
>   $array = array();
>
>   for ($i=0; $i < 3; $i++)
>     $array[] = array("foo" => $i);
>
>   foreach ($array as &$item)
>     $item["bar"] = $item["foo"] * 2;
>
>   print_r($array);
>
>   foreach ($array as $item)
>     print_r($item);
> ?>

Ron, after the first foreach $item still points to the last element of $array (because you've used &$item syntax).
The second foreach changes $item, but it *STILL* references the last element of $array, so it actually changes it instead.

Try to change this part of the code:
foreach ($array as $item)
print_r($item);

to:
foreach ($array as $blah)
print_r($blah);

you'll see it yourself.

I don't see any bugs here.

--
Wbr,
Antony Dovgal

Ron Korving

20 years ago

Okay, you're right that it starts working fine when I rename the $item to
$blah, but your explanation doesn't make much sense.

After the first foreach, $item points to the last one, that I already
figured. If you ask me, the second foreach should replace the instance of
$item, not overwrite it. But it doesn't seem to overwrite it, because if you
look at the results, the last element is replaced by the contents of the one
before the last element. If you do these loops with $i < 10, you will see it
more clearly maybe.

The last item in the array is replaced, not by the first one of the second
foreach, but by the item before the last item. That just doesn't make sense
at all.

And really, I do consider foreach() overwriting previous references a bug.
If it wasn't, then this:

$i=0;
foreach ($array as &$foo)
$foo = $i++;

should have the last value on every item, because within this foreach() the
$foo's should overwrite eachother with your logic.

Ron


"Antony Dovgal" <antony@zend.com> schreef in bericht
news:432ABD29.6000605@zend.com...

> On 16.09.2005 16:29, Ron Korving wrote:
> > My apologies for my DOM-mistake today, but right now I came across

something

> > that totally stunned me. It's a total paradox situation that just has to

be

> > one of the biggest bugs I've ever come across in PHP. Personally, I

think

> > it's rather high-priority because it's an engine problem, and not an

issue

> > with some extension.
> >
> > Here's the code:
> >
> > <?php
> >   $array = array();
> >
> >   for ($i=0; $i < 3; $i++)
> >     $array[] = array("foo" => $i);
> >
> >   foreach ($array as &$item)
> >     $item["bar"] = $item["foo"] * 2;
> >
> >   print_r($array);
> >
> >   foreach ($array as $item)
> >     print_r($item);
> > ?>
>
> Ron, after the first foreach $item still points to the last element of

$array (because you've used &$item syntax).

> The second foreach changes $item, but it *STILL* references the last

element of $array, so it actually changes it instead.

Matthew Charles Kavanagh

20 years ago

Ron Korving wrote:

>The last item in the array is replaced, not by the first one of the second
>foreach, but by the item before the last item. That just doesn't make sense
>at all.
>
>

This is where you're going wrong (and where I was going wrong in
thinking about this before Antony's message). $item points to $array[2]
the whole time, and $array[2] is first overwritten by $array[0], then
$array[1], then $array[2].

This is a pretty interesting oddity in references that I hadn't
considered, though, and I'll be thinking about bizarre things I can do
with this for a while. :)

Ron Korving

20 years ago

Good point. I think it's somehow undesired behavior, but what can one do to
change this? I guess it somehow is desired behavior...

My bad I guess,

Ron

"Matthew Charles Kavanagh" <matthew@teh.ath.cx> schreef in bericht
news:432AC30D.1050105@teh.ath.cx...

> Ron Korving wrote:
>
> >The last item in the array is replaced, not by the first one of the

second

> >foreach, but by the item before the last item. That just doesn't make

sense