com php-src: Revert "Fixed bug #72286 (Segmentation fault During Garbage Collection)": NEWS Zend/tests/bug72286.phpt Zend/zend_gc.c

Commit: 171c759d791f809ebc31711fd0b0b5bb632cd2cc Author: Nikita Popov <nikic@php.net> Sat, 16 Jul 2016 23:00:47 +0200 Parents: 3666cfab973c5aba86d0562d14de8ed74e66cdb7 Branches: PHP-5.6 PHP-7.0 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=171c759d791f809ebc31711fd0b0b5bb632cd2cc Log: Revert "Fixed bug #72286 (Segmentation fault During Garbage Collection)" This reverts commit 1c84b55adea936b065a20102202bea3d1d243225. Bugs: https://bugs.php.net/72286 Changed paths: M NEWS D Zend/tests/bug72286.phpt M Zend/zend_gc.c Diff: diff --git a/NEWS b/NEWS index caf8073..248d568 100644 --- a/NEWS +++ b/NEWS @@ -5,7 +5,6 @@ PHP NEWS - Core: . Fixed bug #72581 (previous property undefined in Exception after deserialization). (Laruence) - . Fixed bug #72286 (Segmentation fault During Garbage Collection). (Dmitry) . Fixed bug #72024 (microtime() leaks memory). (maroszek at gmx dot net) - Curl: diff --git a/Zend/tests/bug72286.phpt b/Zend/tests/bug72286.phpt deleted file mode 100644 index 0f6184d..0000000 --- a/Zend/tests/bug72286.phpt +++ /dev/null @@ -1,51 +0,0 @@ ---TEST-- -Bug #72286 (Segmentation fault During Garbage Collection) ---FILE-- -<?php -class SegfaultScenario -{ - private $circular_reference; - private $object; - - public function __construct() - { - $this->circular_reference = $this; - $this->object = new \stdClass(); - } - - public function __destruct() - { - // we try to avoid accessing $this->object by returning early but the object exists - if (!$this->object) { // without this expression involving the object, the segfault does not happen - var_dump('the object exists'); - return; - } - - var_dump('segfaults here:'); - // and then access the object (which seemingly has already been garbage collected) - var_dump($this->object); - var_dump('will not get here'); - } -} - -class SomeContainer -{ - public function run() - { - new SegfaultScenario(); - } -} - -$container = new SomeContainer(); -$container->run(); - -var_dump('we are about to segfault'); -gc_collect_cycles(); -var_dump('will not get here'); ---EXPECTF-- -string(24) "we are about to segfault" -string(15) "segfaults here:" -object(stdClass)#%d (0) { -} -string(17) "will not get here" -string(17) "will not get here" diff --git a/Zend/zend_gc.c b/Zend/zend_gc.c index 7ad7340..e72655c 100644 --- a/Zend/zend_gc.c +++ b/Zend/zend_gc.c @@ -650,7 +650,6 @@ tail_call: if (!props) { /* restore refcount and put into list to free */ - obj->refcount = 1; pz->refcount__gc++; ((zval_gc_info*)pz)->u.next = GC_G(zval_to_free); GC_G(zval_to_free) = (zval_gc_info*)pz; @@ -757,7 +756,6 @@ static void gc_collect_roots(TSRMLS_D) struct _store_object *obj = &EG(objects_store).object_buckets[current->handle].bucket.obj; zval z; - obj->refcount = 1; GC_SET_ADDRESS(obj->buffered, NULL); INIT_PZVAL(&z); Z_OBJ_HANDLE(z) = current->handle; @@ -804,7 +802,7 @@ ZEND_API int gc_collect_cycles(TSRMLS_D) if (Z_TYPE(p->z) == IS_OBJECT) { if (EG(objects_store).object_buckets && EG(objects_store).object_buckets[Z_OBJ_HANDLE(p->z)].valid && - EG(objects_store).object_buckets[Z_OBJ_HANDLE(p->z)].bucket.obj.refcount <= 1 && + EG(objects_store).object_buckets[Z_OBJ_HANDLE(p->z)].bucket.obj.refcount <= 0 && EG(objects_store).object_buckets[Z_OBJ_HANDLE(p->z)]..bucket.obj.dtor && !EG(objects_store).object_buckets[Z_OBJ_HANDLE(p->z)].destructor_called) { @@ -825,7 +823,7 @@ ZEND_API int gc_collect_cycles(TSRMLS_D) if (Z_TYPE(p->z) == IS_OBJECT) { if (EG(objects_store).object_buckets && EG(objects_store).object_buckets[Z_OBJ_HANDLE(p->z)].valid && - --EG(objects_store).object_buckets[Z_OBJ_HANDLE(p->z)].bucket.obj.refcount <= 0) { + EG(objects_store).object_buckets[Z_OBJ_HANDLE(p->z)].bucket.obj.refcount <= 0) { EG(objects_store).object_buckets[Z_OBJ_HANDLE(p->z)].bucket.obj.refcount = 1; Z_TYPE(p->z) = IS_NULL; zend_objects_store_del_ref_by_handle_ex(Z_OBJ_HANDLE(p->z), Z_OBJ_HT(p->z) TSRMLS_CC);