Fixed bug #63635 (Segfault in gc_collect_cycles)

dstogov · dstogov · commit 92e2f2938115 · 2012-11-29T12:25:20.000+04:00
diff --git a/NEWS b/NEWS
@@ -3,6 +3,7 @@ PHP                                                                        NEWS
 ?? ??? 2012, PHP 5.3.20
 
 - Zend Engine:
+  . Fixed bug #63635 (Segfault in gc_collect_cycles). (Dmitry)
   . Fixed bug #63512 (parse_ini_file() with INI_SCANNER_RAW removes quotes 
     from value). (Pierrick)
   . Fixed bug #63468 (wrong called method as callback with inheritance).
diff --git a/Zend/tests/bug63635.phpt b/Zend/tests/bug63635.phpt
@@ -0,0 +1,58 @@
+--TEST--
+Bug #63635 (Segfault in gc_collect_cycles)
+--FILE--
+<?php
+class Node {
+	public $parent = NULL;
+	public $childs = array();
+	
+	function __construct(Node $parent=NULL) {
+		if ($parent) {
+			$parent->childs[] = $this;
+		}
+		$this->childs[] = $this;
+	}
+	
+	function __destruct() {
+		$this->childs = NULL;
+	}	
+}
+
+define("MAX", 16);
+
+for ($n = 0; $n < 20; $n++) {
+	$top = new Node();
+	for ($i=0 ; $i<MAX ; $i++) {
+		$ci = new Node($top);
+		for ($j=0 ; $j<MAX ; $j++) {
+			$cj = new Node($ci);
+			for ($k=0 ; $k<MAX ; $k++) {
+				$ck = new Node($cj);
+			}
+		}
+	}
+	echo "$n\n";
+}
+echo "ok\n";
+--EXPECT--
+0
+1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+11
+12
+13
+14
+15
+16
+17
+18
+19
+ok
diff --git a/Zend/zend_gc.c b/Zend/zend_gc.c
@@ -553,7 +553,8 @@ static void zval_collect_white(zval *pz TSRMLS_DC)
 			struct _store_object *obj = &EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].bucket.obj;
 
 			if (obj->buffered == (gc_root_buffer*)GC_WHITE) {
-				GC_SET_BLACK(obj->buffered);
+				/* PURPLE instead of BLACK to prevent buffering in nested gc calls */
+				GC_SET_PURPLE(obj->buffered);
 
 				if (EXPECTED(EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].valid &&
 				             Z_OBJ_HANDLER_P(pz, get_properties) != NULL)) {
@@ -598,7 +599,8 @@ static void zobj_collect_white(zval *pz TSRMLS_DC)
 		struct _store_object *obj = &EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].bucket.obj;
 
 		if (obj->buffered == (gc_root_buffer*)GC_WHITE) {
-			GC_SET_BLACK(obj->buffered);
+			/* PURPLE instead of BLACK to prevent buffering in nested gc calls */
+			GC_SET_PURPLE(obj->buffered);
 
 			if (EXPECTED(EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].valid &&
 			             Z_OBJ_HANDLER_P(pz, get_properties) != NULL)) {
