svn: /php/php-src/ branches/PHP_5_3/ext/spl/spl_observer.c branches/PHP_5_3/ext/spl/tests/bug53144.phpt trunk/ext/spl/spl_observer.c
trunk/ext/spl/tests/bug53144.phpt

felipe Sun, 24 Oct 2010 14:03:07 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=304700 Log: - Fixed bug #53144 (SplObjectStorage::removeAll()) Bug: http://bugs.php.net/53144 (Closed) Segfault in SplObjectStorage::removeAll() Changed paths: U php/php-src/branches/PHP_5_3/ext/spl/spl_observer.c A php/php-src/branches/PHP_5_3/ext/spl/tests/bug53144.phpt U php/php-src/trunk/ext/spl/spl_observer.c A php/php-src/trunk/ext/spl/tests/bug53144.phpt Modified: php/php-src/branches/PHP_5_3/ext/spl/spl_observer.c =================================================================== --- php/php-src/branches/PHP_5_3/ext/spl/spl_observer.c 2010-10-24 14:02:47 UTC (rev 304699) +++ php/php-src/branches/PHP_5_3/ext/spl/spl_observer.c 2010-10-24 14:03:07 UTC (rev 304700) @@ -166,17 +166,17 @@ #endif } /* }}} */ -void spl_object_storage_detach(spl_SplObjectStorage *intern, zval *obj TSRMLS_DC) /* {{{ */ +int spl_object_storage_detach(spl_SplObjectStorage *intern, zval *obj TSRMLS_DC) /* {{{ */ { #if HAVE_PACKED_OBJECT_VALUE - zend_hash_del(&intern->storage, (char*)&Z_OBJVAL_P(obj), sizeof(zend_object_value)); + return zend_hash_del(&intern->storage, (char*)&Z_OBJVAL_P(obj), sizeof(zend_object_value)); #else { zend_object_value zvalue; memset(&zvalue, 0, sizeof(zend_object_value)); zvalue.handle = Z_OBJ_HANDLE_P(obj); zvalue.handlers = Z_OBJ_HT_P(obj); - zend_hash_del(&intern->storage, (char*)&zvalue, sizeof(zend_object_value)); + return zend_hash_del(&intern->storage, (char*)&zvalue, sizeof(zend_object_value)); } #endif } /* }}}*/ @@ -412,7 +412,6 @@ spl_SplObjectStorage *intern = (spl_SplObjectStorage *)zend_object_store_get_object(getThis() TSRMLS_CC); spl_SplObjectStorage *other; spl_SplObjectStorageElement *element; - HashPosition pos; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "O", &obj, spl_ce_SplObjectStorage) == FAILURE) { return; @@ -420,10 +419,11 @@ other = (spl_SplObjectStorage *)zend_object_store_get_object(obj TSRMLS_CC); - zend_hash_internal_pointer_reset_ex(&other->storage, &pos); - while (zend_hash_get_current_data_ex(&other->storage, (void **)&element, &pos) == SUCCESS) { - spl_object_storage_detach(intern, element->obj TSRMLS_CC); - zend_hash_move_forward_ex(&other->storage, &pos); + zend_hash_internal_pointer_reset(&other->storage); + while (zend_hash_get_current_data(&other->storage, (void **)&element) == SUCCESS) { + if (spl_object_storage_detach(intern, element->obj TSRMLS_CC) == FAILURE) { + zend_hash_move_forward(&other->storage); + } } zend_hash_internal_pointer_reset_ex(&intern->storage, &intern->pos); Added: php/php-src/branches/PHP_5_3/ext/spl/tests/bug53144.phpt =================================================================== --- php/php-src/branches/PHP_5_3/ext/spl/tests/bug53144.phpt (rev 0) +++ php/php-src/branches/PHP_5_3/ext/spl/tests/bug53144.phpt 2010-10-24 14:03:07 UTC (rev 304700) @@ -0,0 +1,20 @@ +--TEST-- +Bug #53144 (Segfault in SplObjectStorage::removeAll) +--FILE-- +<?php + +$o1 = new StdClass; +$o2 = new StdClass; + +$b = new SplObjectStorage(); +$b[$o1] = "bar"; +$b[$o2] = "baz"; + +var_dump(count($b)); +$b->removeAll($b); +var_dump(count($b)); + +?> +--EXPECTF-- +int(2) +int(0) \ No newline at end of file Property changes on: php/php-src/branches/PHP_5_3/ext/spl/tests/bug53144.phpt ___________________________________________________________________ Added: svn:keywords + Id Rev Revision Added: svn:eol-style + native Modified: php/php-src/trunk/ext/spl/spl_observer.c =================================================================== --- php/php-src/trunk/ext/spl/spl_observer.c 2010-10-24 14:02:47 UTC (rev 304699) +++ php/php-src/trunk/ext/spl/spl_observer.c 2010-10-24 14:03:07 UTC (rev 304700) @@ -223,15 +223,17 @@ spl_object_storage_free_hash(intern, hash); } /* }}} */ -void spl_object_storage_detach(spl_SplObjectStorage *intern, zval *this, zval *obj TSRMLS_DC) /* {{{ */ +int spl_object_storage_detach(spl_SplObjectStorage *intern, zval *this, zval *obj TSRMLS_DC) /* {{{ */ { - int hash_len; + int hash_len, ret = FAILURE; char *hash = spl_object_storage_get_hash(intern, this, obj, &hash_len TSRMLS_CC); if (!hash) { - return; + return ret; } - zend_hash_del(&intern->storage, hash, hash_len); + ret = zend_hash_del(&intern->storage, hash, hash_len); spl_object_storage_free_hash(intern, hash); + + return ret; } /* }}}*/ void spl_object_storage_addall(spl_SplObjectStorage *intern, zval *this, spl_SplObjectStorage *other TSRMLS_DC) { /* {{{ */ @@ -505,7 +507,6 @@ spl_SplObjectStorage *intern = (spl_SplObjectStorage *)zend_object_store_get_object(getThis() TSRMLS_CC); spl_SplObjectStorage *other; spl_SplObjectStorageElement *element; - HashPosition pos; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "O", &obj, spl_ce_SplObjectStorage) == FAILURE) { return; @@ -513,10 +514,11 @@ other = (spl_SplObjectStorage *)zend_object_store_get_object(obj TSRMLS_CC); - zend_hash_internal_pointer_reset_ex(&other->storage, &pos); - while (zend_hash_get_current_data_ex(&other->storage, (void **)&element, &pos) == SUCCESS) { - spl_object_storage_detach(intern, getThis(), element->obj TSRMLS_CC); - zend_hash_move_forward_ex(&other->storage, &pos); + zend_hash_internal_pointer_reset(&other->storage); + while (zend_hash_get_current_data(&other->storage, (void **)&element) == SUCCESS) { + if (spl_object_storage_detach(intern, getThis(), element->obj TSRMLS_CC) == FAILURE) { + zend_hash_move_forward(&other->storage); + } } zend_hash_internal_pointer_reset_ex(&intern->storage, &intern->pos); Added: php/php-src/trunk/ext/spl/tests/bug53144.phpt =================================================================== --- php/php-src/trunk/ext/spl/tests/bug53144.phpt (rev 0) +++ php/php-src/trunk/ext/spl/tests/bug53144.phpt 2010-10-24 14:03:07 UTC (rev 304700) @@ -0,0 +1,20 @@ +--TEST-- +Bug #53144 (Segfault in SplObjectStorage::removeAll) +--FILE-- +<?php + +$o1 = new StdClass; +$o2 = new StdClass; + +$b = new SplObjectStorage(); +$b[$o1] = "bar"; +$b[$o2] = "baz"; + +var_dump(count($b)); +$b->removeAll($b); +var_dump(count($b)); + +?> +--EXPECTF-- +int(2) +int(0) \ No newline at end of file Property changes on: php/php-src/trunk/ext/spl/tests/bug53144.phpt ___________________________________________________________________ Added: svn:keywords + Id Rev Revision Added: svn:eol-style + native