Fixed bug #32799 (crash: calling the corresponding global var during the destruct)

diff --git a/NEWS b/NEWS
index ce8eabf1ae03275a66a8546dceecc13059388cd4..1b4f5dcff3c0e5598082ac0a750c9d405330341c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -58,6 +58,8 @@ PHP                                                                        NEWS
 - Fixed bug #32809 (Missing T1LIB support on Windows). (Edin)
 - Fixed bug #32802 (General cookie overrides more specific cookie). (Ilia)
 - Fixed bugs #32800, #32830 (ext/odbc: Problems with 64bit systems). (Jani)
+- Fixed bug #32799 (crash: calling the corresponding global var during the
+  destruct). (Dmitry)
 - Fixed bug #32776 (SOAP doesn't support one-way operations). (Dmitry)
 - Fixed bug #32773 (GMP functions break when second parameter is 0). (Stas)
 - Fixed bug #32759 (incorrect determination of default value (COM)). (Wez)

diff --git a/Zend/tests/bug32799.phpt b/Zend/tests/bug32799.phpt
new file mode 100755 (executable)
index 0000000..7b09a50
--- /dev/null
+++ b/Zend/tests/bug32799.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #32799 (crash: calling the corresponding global var during the destruct)
+--FILE--
+<?php
+class test{
+  public $c=1;
+  function __destruct (){
+    $GLOBALS['p']->c++; // no warning
+    print $GLOBALS['p']->c."\n"; // segfault
+       var_dump($GLOBALS['p']);
+  }
+}
+$p=new test;
+$p=null; //destroy the object by a new assignment (segfault)
+?>
+--EXPECT--
+2
+object(test)#1 (1) {
+  ["c"]=>
+  int(2)
+}

diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c
index 6aa2d80b5684a3c1e68b17e5b2d4f028edeb18e7..d37b4976e8281f690a3ddc55e8631ea2134d9692 100644 (file)
--- a/Zend/zend_objects_API.c
+++ b/Zend/zend_objects_API.c
@@ -151,7 +151,9 @@ ZEND_API void zend_objects_store_del_ref(zval *zobject TSRMLS_DC)
                                EG(objects_store).object_buckets[handle].destructor_called = 1;
 
                                if (obj->dtor) {
+                                       zobject->refcount++;
                                        obj->dtor(obj->object, handle TSRMLS_CC);
+                                       zobject->refcount--;
                                }
                        }
                        if (obj->refcount == 1) {