com php-src: Fixed bug #73288 (Segfault in __clone > Exception.toString > __get): NEWS Zend/test s/bug73288.phpt Zend/zend_vm_def.h Zend/z
end_vm_execute.h

Commit: d19898b2981c839f0758571c1b83052111634154 Author: Xinchen Hui <laruence@gmail.com> Wed, 12 Oct 2016 16:07:56 +0800 Parents: 9f86cdaf7fc44c0d97a35bc4d04622e3d3d53f4d Branches: PHP-7.1 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=d19898b2981c839f0758571c1b83052111634154 Log: Fixed bug #73288 (Segfault in __clone > Exception.toString > __get) Actually this is caused by optimization(opcache) Bugs: https://bugs.php.net/73288 Changed paths: M NEWS A Zend/tests/bug73288.phpt M Zend/zend_vm_def.h M Zend/zend_vm_execute.h Diff: diff --git a/NEWS b/NEWS index 6268c54..a9cebe9 100644 --- a/NEWS +++ b/NEWS @@ -3,6 +3,8 @@ PHP NEWS ?? ??? 2016, PHP 7.1.0RC4 - Core: + . Fixed bug #73288 (Segfault in __clone > Exception.toString > __get). + (Laruence) . Implemented RFC: get_class() disallow null parameter. Passing null to get_class() now generates a warning, rather than returning the calling class scope. diff --git a/Zend/tests/bug73288.phpt b/Zend/tests/bug73288..phpt new file mode 100644 index 0000000..fefcf3b --- /dev/null +++ b/Zend/tests/bug73288.phpt @@ -0,0 +1,34 @@ +--TEST-- +Bug #73288 (Segfault in __clone > Exception.toString > __get) +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +--FILE-- +<?php + +class NoClone { + public function __clone() { + throw new Exception("No Cloneable"); + } +} + +class C { + public function __get($name) { + return new NoClone; + } +} + +function test_clone() { + $c = new C; + $b = clone $c->x; +} + +test_clone(); +?> +--EXPECTF-- +Fatal error: Uncaught Exception: No Cloneable in %sbug73288.php:%d +Stack trace: +#0 %s(%d): NoClone->__clone() +#1 %s(%d): test_clone() +#2 {main} + thrown in %sbug73288.php on line %d diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index 7bad61d..c5dc325 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -5000,6 +5000,7 @@ ZEND_VM_HANDLER(110, ZEND_CLONE, CONST|TMPVAR|UNUSED|THIS|CV, ANY) USE_OPLINE zend_free_op free_op1; zval *obj; + zend_object *clone_obj; zend_class_entry *ce, *scope; zend_function *clone; zend_object_clone_obj_t clone_call; @@ -5064,9 +5065,11 @@ ZEND_VM_HANDLER(110, ZEND_CLONE, CONST|TMPVAR|UNUSED|THIS|CV, ANY) } } - ZVAL_OBJ(EX_VAR(opline->result.var), clone_call(obj)); - if (UNEXPECTED(EG(exception) != NULL)) { - OBJ_RELEASE(Z_OBJ_P(EX_VAR(opline->result.var))); + clone_obj = clone_call(obj); + if (EXPECTED(EG(exception) == NULL)) { + ZVAL_OBJ(EX_VAR(opline->result.var), clone_obj); + } else { + OBJ_RELEASE(clone_obj); } FREE_OP1(); diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index 677a217..61e63fa 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -3231,6 +3231,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CLONE_SPEC_CONST_HANDLER(ZEND_ USE_OPLINE zval *obj; + zend_object *clone_obj; zend_class_entry *ce, *scope; zend_function *clone; zend_object_clone_obj_t clone_call; @@ -3295,9 +3296,11 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CLONE_SPEC_CONST_HANDLER(ZEND_ } } - ZVAL_OBJ(EX_VAR(opline->result.var), clone_call(obj)); - if (UNEXPECTED(EG(exception) != NULL)) { - OBJ_RELEASE(Z_OBJ_P(EX_VAR(opline->result.var))); + clone_obj = clone_call(obj); + if (EXPECTED(EG(exception) == NULL)) { + ZVAL_OBJ(EX_VAR(opline->result.var), clone_obj); + } else { + OBJ_RELEASE(clone_obj); } ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION(); @@ -27784,6 +27787,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CLONE_SPEC_UNUSED_HANDLER(ZEND USE_OPLINE zval *obj; + zend_object *clone_obj; zend_class_entry *ce, *scope; zend_function *clone; zend_object_clone_obj_t clone_call; @@ -27848,9 +27852,11 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CLONE_SPEC_UNUSED_HANDLER(ZEND } } - ZVAL_OBJ(EX_VAR(opline->result.var), clone_call(obj)); - if (UNEXPECTED(EG(exception) != NULL)) { - OBJ_RELEASE(Z_OBJ_P(EX_VAR(opline->result.var))); + clone_obj = clone_call(obj); + if (EXPECTED(EG(exception) == NULL)) { + ZVAL_OBJ(EX_VAR(opline->result.var), clone_obj); + } else { + OBJ_RELEASE(clone_obj); } ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION(); @@ -35107,6 +35113,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CLONE_SPEC_CV_HANDLER(ZEND_OPC USE_OPLINE zval *obj; + zend_object *clone_obj; zend_class_entry *ce, *scope; zend_function *clone; zend_object_clone_obj_t clone_call; @@ -35171,9 +35178,11 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CLONE_SPEC_CV_HANDLER(ZEND_OPC } } - ZVAL_OBJ(EX_VAR(opline->result.var), clone_call(obj)); - if (UNEXPECTED(EG(exception) != NULL)) { - OBJ_RELEASE(Z_OBJ_P(EX_VAR(opline->result.var))); + clone_obj = clone_call(obj); + if (EXPECTED(EG(exception) == NULL)) { + ZVAL_OBJ(EX_VAR(opline->result.var), clone_obj); + } else { + OBJ_RELEASE(clone_obj); } ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION(); @@ -51305,6 +51314,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CLONE_SPEC_TMPVAR_HANDLER(ZEND USE_OPLINE zend_free_op free_op1; zval *obj; + zend_object *clone_obj; zend_class_entry *ce, *scope; zend_function *clone; zend_object_clone_obj_t clone_call; @@ -51369,9 +51379,11 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CLONE_SPEC_TMPVAR_HANDLER(ZEND } } - ZVAL_OBJ(EX_VAR(opline->result.var), clone_call(obj)); - if (UNEXPECTED(EG(exception) != NULL)) { - OBJ_RELEASE(Z_OBJ_P(EX_VAR(opline->result.var))); + clone_obj = clone_call(obj); + if (EXPECTED(EG(exception) == NULL)) { + ZVAL_OBJ(EX_VAR(opline->result.var), clone_obj); + } else { + OBJ_RELEASE(clone_obj); } zval_ptr_dtor_nogc(free_op1);