Fixed bug #68652 (segmentation fault in destructor)

dstogov · dstogov · commit 21bb33cc723c · 2015-04-06T18:11:41.000+03:00
diff --git a/NEWS b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2015, PHP 5.5.25
 
+- Core:
+  . Fixed bug #68652 (segmentation fault in destructor). (Dmitry)
+
 - cURL:
   . Fixed bug #68739 (Missing break / control flow). (Laruence)
 
diff --git a/Zend/tests/bug68652.phpt b/Zend/tests/bug68652.phpt
@@ -0,0 +1,40 @@
+--TEST--
+Bug #68652 (segmentation fault in destructor)
+--FILE--
+<?php
+class Foo {
+
+    private static $instance;
+    public static function getInstance() {
+        if (isset(self::$instance)) {
+            return self::$instance;
+        }
+        return self::$instance = new self();
+    }
+
+    public function __destruct() {
+        Bar::getInstance();
+    }
+}
+
+class Bar {
+
+    private static $instance;
+    public static function getInstance() {
+        if (isset(self::$instance)) {
+            return self::$instance;
+        }
+        return self::$instance = new self();
+    }
+
+    public function __destruct() {
+        Foo::getInstance();
+    }
+}
+
+
+$foo = new Foo();
+?>
+--EXPECTF--
+Fatal error: Access to undeclared static property: Bar::$instance in %sbug68652.php on line %d
+
diff --git a/Zend/zend_opcode.c b/Zend/zend_opcode.c
@@ -162,16 +162,16 @@ static inline void cleanup_user_class_data(zend_class_entry *ce TSRMLS_DC)
 		zend_hash_apply(&ce->function_table, (apply_func_t) zend_cleanup_function_data_full TSRMLS_CC);
 	}
 	if (ce->static_members_table) {
+		zval *static_members = ce->static_members_table;
+		int count = ce->default_static_members_count;
 		int i;
 
-		for (i = 0; i < ce->default_static_members_count; i++) {
-			if (ce->static_members_table[i]) {
-				zval *p = ce->static_members_table[i];
-				ce->static_members_table[i] = NULL;
-				zval_ptr_dtor(&p);
-			}
+		ce->default_static_members_count = 0;
+		ce->default_static_members_table = ce->static_members_table = NULL;
+		for (i = 0; i < count; i++) {
+			zval_ptr_dtor(&static_members[i]);
 		}
-		ce->static_members_table = NULL;
+		efree(static_members);
 	}
 }
 

Original file line number	Diff line number	Diff line change
`@@ -162,16 +162,16 @@ static inline void cleanup_user_class_data(zend_class_entry *ce TSRMLS_DC)`
`162`	`162`	`zend_hash_apply(&ce->function_table, (apply_func_t) zend_cleanup_function_data_full TSRMLS_CC);`
`163`	`163`	`}`
`164`	`164`	`if (ce->static_members_table) {`
	`165`	`+ zval *static_members = ce->static_members_table;`
	`166`	`+ int count = ce->default_static_members_count;`
`165`	`167`	`int i;`
`166`	`168`
`167`		`- for (i = 0; i < ce->default_static_members_count; i++) {`
`168`		`- if (ce->static_members_table[i]) {`
`169`		`- zval *p = ce->static_members_table[i];`
`170`		`- ce->static_members_table[i] = NULL;`
`171`		`- zval_ptr_dtor(&p);`
`172`		`- }`
	`169`	`+ ce->default_static_members_count = 0;`
	`170`	`+ ce->default_static_members_table = ce->static_members_table = NULL;`
	`171`	`+ for (i = 0; i < count; i++) {`
	`172`	`+ zval_ptr_dtor(&static_members[i]);`
`173`	`173`	`}`
`174`		`- ce->static_members_table = NULL;`
	`174`	`+ efree(static_members);`
`175`	`175`	`}`
`176`	`176`	`}`
`177`	`177`