Re: [ZEND-ENGINE-CVS] cvs: ZendEngine2 / zend_operators.c

Oh? The problem is that zendi effectively trashes the pointer to a temporary zval created by tostring. The consequence is that the trashed zval is leaked and when we try to free the zval we have another tmp zval this time who's refcount in a random value, which explains the crash. Ilia Andi Gutmans wrote:

andi Wed Oct 27 14:15:03 2004 EDT

  Modified files:                  /ZendEngine2	zend_operators.c   Log:

- Revert Fixed bug #30228 (crash when comparing SimpleXML attribute to a boolean). - Need to discuss where the real problem is. http://cvs.php.net/diff.php/ZendEngine2/zend_operators.c?r1=1.199&r2=1.200&ty=u Index: ZendEngine2/zend_operators.c diff -u ZendEngine2/zend_operators.c:1.199 ZendEngine2/zend_operators.c:1.200 --- ZendEngine2/zend_operators.c:1.199 Tue Oct 26 18:38:34 2004 +++ ZendEngine2/zend_operators.c Wed Oct 27 14:15:03 2004 @@ -17,7 +17,7 @@

    +----------------------------------------------------------------------+

*/ -/* $Id: zend_operators.c,v 1.199 2004/10/26 22:38:34 iliaa Exp $ */ +/* $Id: zend_operators.c,v 1.200 2004/10/27 18:15:03 andi Exp $ */ #include <ctype.h> @@ -1323,11 +1323,7 @@ if (op1->type == IS_BOOL || op2->type == IS_BOOL || op1->type == IS_NULL || op2->type == IS_NULL) { - if (free_op1) { - convert_to_boolean(op1); - } else { - zendi_convert_to_boolean(op1, op1_copy, result); - } + zendi_convert_to_boolean(op1, op1_copy, result); zendi_convert_to_boolean(op2, op2_copy, result); result->type = IS_LONG; result->value.lval = ZEND_NORMALIZE_BOOL(op1->value.lval-op2->value.lval);