bug60598

gistfile1.diff

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index c3d62c2..884657f 100644
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -1102,6 +1102,9 @@ ZEND_API void object_properties_init(zend_object *object, zend_class_entry *clas
 			}
 		}
 		object->properties = NULL;
+		fprintf(stderr, "[object_properties_init]\n");
+		fprintf(stderr, "  name=%s addr=%x pt_addr=%x\n", object->ce->name, object, object->properties_table);
+		fprintf(stderr, "  pt[0]_addr=%x pt[0].handle=#%d\n", object->properties_table[0], Z_OBJ_HANDLE_P(object->properties_table[0]));
 	}
 }
 /* }}} */
diff --git a/Zend/zend_gc.c b/Zend/zend_gc.c
index 84a99c1..5b57fdc 100644
--- a/Zend/zend_gc.c
+++ b/Zend/zend_gc.c
@@ -689,6 +689,9 @@ tail_call:
 		/* restore refcount and put into list to free */
 		pz->refcount__gc++;
 		((zval_gc_info*)pz)->u.next = GC_G(zval_to_free);
+		fprintf(stderr, "[zval_collect_white]\n");
+		fprintf(stderr, "  adding zval to zval_to_free-list\n");
+		fprintf(stderr, "  zval: addr=%x refcnt=%d handle=#%d\n", pz, Z_REFCOUNT_P(pz), Z_OBJ_HANDLE_P(pz));
 		GC_G(zval_to_free) = (zval_gc_info*)pz;
 
 		while (p != NULL) {
@@ -845,6 +848,9 @@ ZEND_API int gc_collect_cycles(TSRMLS_D)
 		/* Free zvals */
 		p = GC_G(free_list);
 		while (p != FREE_LIST_END) {
+			fprintf(stderr, "[gc_collect_cycles]\n");
+			fprintf(stderr, "  freeing zval\n");
+			fprintf(stderr, "  zval: addr=%x refcnt=%d handle=#%d\n", &p->z, Z_REFCOUNT_P(&p->z), Z_OBJ_HANDLE_P(&p->z));
 			q = p->u.next;
 			FREE_ZVAL_EX(&p->z);
 			p = q;
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index d82493a..d392899 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -549,6 +549,9 @@ ZEND_API void zend_std_write_property(zval *object, zval *member, zval *value, c
 				if (PZVAL_IS_REF(value)) {
 					SEPARATE_ZVAL(&value);
 				}
+				fprintf(stderr, "[zend_std_write_property]\n");
+				fprintf(stderr, "  name=%s (=pt[%d])\n", property_info->name+3, property_info->offset);
+				fprintf(stderr, "  old_addr=%x new_addr=%x new.handle=#%d\n", garbage, value, Z_OBJ_HANDLE_P(value));
 				*variable_ptr = value;
 				zval_ptr_dtor(&garbage);
 			}
diff --git a/Zend/zend_objects.c b/Zend/zend_objects.c
index f7470fa..73bcfee 100644
--- a/Zend/zend_objects.c
+++ b/Zend/zend_objects.c
@@ -51,6 +51,9 @@ ZEND_API void zend_object_std_dtor(zend_object *object TSRMLS_DC)
 
 		for (i = 0; i < object->ce->default_properties_count; i++) {
 			if (object->properties_table[i]) {
+			  fprintf(stderr, "[zend_object_std_dtor]\n");
+			  fprintf(stderr, "  object=%s addr=%x pt_addr=%x\n", object->ce->name, object, object->properties_table);
+			  fprintf(stderr, "  calling zval_ptr_dtor for pt[%d]_addr=%x pt[%d].handle=#%d\n", i, object->properties_table[i], i, Z_OBJ_HANDLE_P(object->properties_table[i]));
 				zval_ptr_dtor(&object->properties_table[i]);
 			}
 		}
diff --git a/bug60598.php b/bug60598.php
new file mode 100644
index 0000000..619c5a9
--- /dev/null
+++ b/bug60598.php
@@ -0,0 +1,23 @@
+<?php
+define('OBJECT_COUNT', 2);
+
+class Object
+{
+  private static $world = array();
+  private static $maxGuid = 0;
+  protected $_guid = null;
+
+  public function __construct()
+  {
+    self::$world[$this->_guid = self::$maxGuid++] = $this;
+  }
+
+  public function __destruct()
+  {
+    unset(self::$world[$this->_guid]);
+    gc_collect_cycles();
+  }
+}
+
+for ($i = 0; $i < OBJECT_COUNT; ++$i)
+  new Object();