Skip to content

Instantly share code, notes, and snippets.

@dstogov

dstogov/bug70805.diff

Created November 3, 2015 19:40
Download ZIP
Raw
bug70805.diff
diff --git a/Zend/zend_gc.c b/Zend/zend_gc.c
index e223a49..74c5348 100644
--- a/Zend/zend_gc.c
+++ b/Zend/zend_gc.c
@@ -242,6 +242,13 @@ ZEND_API void ZEND_FASTCALL gc_possible_root(zend_refcounted *ref)
GC_REFCOUNT(ref)++;
gc_collect_cycles();
GC_REFCOUNT(ref)--;
+ if (UNEXPECTED(GC_REFCOUNT(ref)) == 0) {
+ zval_dtor_func_for_ptr(ref);
+ return;
+ }
+ if (UNEXPECTED(GC_INFO(ref))) {
+ return;
+ }
newRoot = GC_G(unused);
if (!newRoot) {
#if ZEND_GC_DEBUG
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 8a8ef29..52868cf 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -1049,9 +1049,13 @@ ZEND_API int ZEND_FASTCALL zend_hash_del_ind(HashTable *ht, zend_string *key)
return FAILURE;
} else {
if (ht->pDestructor) {
- ht->pDestructor(data);
+ zval tmp;
+ ZVAL_COPY_VALUE(&tmp, data);
+ ZVAL_UNDEF(data);
+ ht->pDestructor(&tmp);
+ } else {
+ ZVAL_UNDEF(data);
}
- ZVAL_UNDEF(data);
}
} else {
_zend_hash_del_el_ex(ht, idx, p, prev);
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index ad6dc58..1fc343b 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -5513,8 +5513,14 @@ ZEND_VM_HANDLER(74, ZEND_UNSET_VAR, CONST|TMPVAR|CV, UNUSED|CONST|VAR)
ZVAL_UNDEF(var);
zval_dtor_func_for_ptr(garbage);
} else {
- GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
- ZVAL_UNDEF(var);
+ zval *z = var;
+ ZVAL_DEREF(z);
+ if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+ ZVAL_UNDEF(var);
+ gc_possible_root(Z_COUNTED_P(z));
+ } else {
+ ZVAL_UNDEF(var);
+ }
}
} else {
ZVAL_UNDEF(var);
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 97e08b7..dcf0f07 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -6105,8 +6105,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CONST_CONST_HAN
ZVAL_UNDEF(var);
zval_dtor_func_for_ptr(garbage);
} else {
- GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
- ZVAL_UNDEF(var);
+ zval *z = var;
+ ZVAL_DEREF(z);
+ if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+ ZVAL_UNDEF(var);
+ gc_possible_root(Z_COUNTED_P(z));
+ } else {
+ ZVAL_UNDEF(var);
+ }
}
} else {
ZVAL_UNDEF(var);
@@ -7034,8 +7040,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CONST_VAR_HANDL
ZVAL_UNDEF(var);
zval_dtor_func_for_ptr(garbage);
} else {
- GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
- ZVAL_UNDEF(var);
+ zval *z = var;
+ ZVAL_DEREF(z);
+ if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+ ZVAL_UNDEF(var);
+ gc_possible_root(Z_COUNTED_P(z));
+ } else {
+ ZVAL_UNDEF(var);
+ }
}
} else {
ZVAL_UNDEF(var);
@@ -7894,8 +7906,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CONST_UNUSED_HA
ZVAL_UNDEF(var);
zval_dtor_func_for_ptr(garbage);
} else {
- GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
- ZVAL_UNDEF(var);
+ zval *z = var;
+ ZVAL_DEREF(z);
+ if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+ ZVAL_UNDEF(var);
+ gc_possible_root(Z_COUNTED_P(z));
+ } else {
+ ZVAL_UNDEF(var);
+ }
}
} else {
ZVAL_UNDEF(var);
@@ -32128,8 +32146,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CV_CONST_HANDLE
ZVAL_UNDEF(var);
zval_dtor_func_for_ptr(garbage);
} else {
- GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
- ZVAL_UNDEF(var);
+ zval *z = var;
+ ZVAL_DEREF(z);
+ if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+ ZVAL_UNDEF(var);
+ gc_possible_root(Z_COUNTED_P(z));
+ } else {
+ ZVAL_UNDEF(var);
+ }
}
} else {
ZVAL_UNDEF(var);
@@ -33412,8 +33436,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CV_VAR_HANDLER(
ZVAL_UNDEF(var);
zval_dtor_func_for_ptr(garbage);
} else {
- GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
- ZVAL_UNDEF(var);
+ zval *z = var;
+ ZVAL_DEREF(z);
+ if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+ ZVAL_UNDEF(var);
+ gc_possible_root(Z_COUNTED_P(z));
+ } else {
+ ZVAL_UNDEF(var);
+ }
}
} else {
ZVAL_UNDEF(var);
@@ -34642,8 +34672,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_CV_UNUSED_HANDL
ZVAL_UNDEF(var);
zval_dtor_func_for_ptr(garbage);
} else {
- GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
- ZVAL_UNDEF(var);
+ zval *z = var;
+ ZVAL_DEREF(z);
+ if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+ ZVAL_UNDEF(var);
+ gc_possible_root(Z_COUNTED_P(z));
+ } else {
+ ZVAL_UNDEF(var);
+ }
}
} else {
ZVAL_UNDEF(var);
@@ -41847,8 +41883,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_TMPVAR_CONST_HA
ZVAL_UNDEF(var);
zval_dtor_func_for_ptr(garbage);
} else {
- GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
- ZVAL_UNDEF(var);
+ zval *z = var;
+ ZVAL_DEREF(z);
+ if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+ ZVAL_UNDEF(var);
+ gc_possible_root(Z_COUNTED_P(z));
+ } else {
+ ZVAL_UNDEF(var);
+ }
}
} else {
ZVAL_UNDEF(var);
@@ -42432,8 +42474,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_TMPVAR_VAR_HAND
ZVAL_UNDEF(var);
zval_dtor_func_for_ptr(garbage);
} else {
- GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
- ZVAL_UNDEF(var);
+ zval *z = var;
+ ZVAL_DEREF(z);
+ if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+ ZVAL_UNDEF(var);
+ gc_possible_root(Z_COUNTED_P(z));
+ } else {
+ ZVAL_UNDEF(var);
+ }
}
} else {
ZVAL_UNDEF(var);
@@ -42834,8 +42882,14 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_UNSET_VAR_SPEC_TMPVAR_UNUSED_H
ZVAL_UNDEF(var);
zval_dtor_func_for_ptr(garbage);
} else {
- GC_ZVAL_CHECK_POSSIBLE_ROOT(var);
- ZVAL_UNDEF(var);
+ zval *z = var;
+ ZVAL_DEREF(z);
+ if (Z_COLLECTABLE_P(z) && UNEXPECTED(!Z_GC_INFO_P(z))) {
+ ZVAL_UNDEF(var);
+ gc_possible_root(Z_COUNTED_P(z));
+ } else {
+ ZVAL_UNDEF(var);
+ }
}
} else {
ZVAL_UNDEF(var);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment