com php-src: Fixed bug #70215 (segfault when __invoke is static): NEWS Zend/tests/bug70215.phpt Zend/zend_vm_def.h Zend/zend_vm_execute.h

Commit: cab75d8b00b6e86f6e2ede1ba3b3bd35518fc3bd Author: Bob Weinand <bobwei9@hotmail.com> Sat, 8 Aug 2015 16:19:12 +0200 Parents: 0c60524190b15fbc583db44b8cb4e3fddac9549c Branches: PHP-7.0.0 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=cab75d8b00b6e86f6e2ede1ba3b3bd35518fc3bd Log: Fixed bug #70215 (segfault when __invoke is static) Bugs: https://bugs.php.net/70215 Changed paths: M NEWS A Zend/tests/bug70215.phpt M Zend/zend_vm_def.h M Zend/zend_vm_execute.h Diff: diff --git a/NEWS b/NEWS index 22371a5..4862c9e 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,12 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| 20 Aug 2015, PHP 7.0.0 RC 1 +- Code: + . Fixed bug #70215 (Segfault when __invoke is static). (Bob) + +- Phpdbg: + . Fixed bug #70214 (FASYNC not defined, needs sys/file.h include). (Bob) + - Standard: . Fixed bug #70208 (Assert breaking access on objects). (Bob) diff --git a/Zend/tests/bug70215.phpt b/Zend/tests/bug70215.phpt new file mode 100644 index 0000000..527920c --- /dev/null +++ b/Zend/tests/bug70215.phpt @@ -0,0 +1,21 @@ +--TEST-- +Bug #70215 (Segfault when invoke is static) +--FILE-- +<?php + +class A { + public static function __invoke() { + echo __CLASS__; + } +} + +class B extends A { } + +$b = new B; + +$b(); + +?> +--EXPECTF-- +Warning: The magic method __invoke() must have public visibility and cannot be static in %s on line %d +A diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index b3ae031..6339ec6 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -3249,7 +3249,7 @@ ZEND_VM_C_LABEL(try_function_name): ZEND_ASSERT(GC_TYPE(fbc->common.prototype) == IS_OBJECT); GC_REFCOUNT(fbc->common.prototype)++; call_info |= ZEND_CALL_CLOSURE; - } else { + } else if (object) { call_info |= ZEND_CALL_RELEASE_THIS; GC_REFCOUNT(object)++; /* For $this pointer */ } diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index f1927ff..a0a1c1f 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -2019,7 +2019,7 @@ try_function_name: ZEND_ASSERT(GC_TYPE(fbc->common.prototype) == IS_OBJECT); GC_REFCOUNT(fbc->common.prototype)++; call_info |= ZEND_CALL_CLOSURE; - } else { + } else if (object) { call_info |= ZEND_CALL_RELEASE_THIS; GC_REFCOUNT(object)++; /* For $this pointer */ } @@ -2441,7 +2441,7 @@ try_function_name: ZEND_ASSERT(GC_TYPE(fbc->common.prototype) == IS_OBJECT); GC_REFCOUNT(fbc->common.prototype)++; call_info |= ZEND_CALL_CLOSURE; - } else { + } else if (object) { call_info |= ZEND_CALL_RELEASE_THIS; GC_REFCOUNT(object)++; /* For $this pointer */ } @@ -2696,7 +2696,7 @@ try_function_name: ZEND_ASSERT(GC_TYPE(fbc->common.prototype) == IS_OBJECT); GC_REFCOUNT(fbc->common.prototype)++; call_info |= ZEND_CALL_CLOSURE; - } else { + } else if (object) { call_info |= ZEND_CALL_RELEASE_THIS; GC_REFCOUNT(object)++; /* For $this pointer */ }