Fixed bug #61998 (Using traits with method aliases appears to result in crash during...

diff --git a/NEWS b/NEWS
index 1a87234b67e113b1217a6046307fb580412fbb2e..68f0a3563ae960986a8d5dc02f4f0637df2171c5 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -19,6 +19,8 @@ PHP                                                                        NEWS
   . Fixed missing bound check in iptcparse(). (chris at chiappa.net)
   . Fixed bug #62005 (unexpected behavior when incrementally assigning to a 
     member of a null object). (Laruence)
+  . Fixed bug #61998 (Using traits with method aliases appears to result in
+    crash during execution). (Dmitry)
   . Fixed bug #61978 (Object recursion not detected for classes that implement
     JsonSerializable). (Felipe)
   . Fixed bug #61991 (long overflow in realpath_cache_get()). (Anatoliy)

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 602b6004100b4505a4e3c4e630c84e57edf5c077..b7e7cd3bbbf43c7faf7817cce6762abe1da701d4 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -3619,6 +3619,7 @@ ZEND_API void zend_do_implement_trait(zend_class_entry *ce, zend_class_entry *tr
                        }
                }
                ce->traits[ce->num_traits++] = trait;
+               trait->refcount++;
        }
 }
 /* }}} */
@@ -3870,8 +3871,8 @@ static int zend_traits_copy_functions(zend_function *fn TSRMLS_DC, int num_args,
                                fn_copy = *fn;
                                function_add_ref(&fn_copy);
                                /* this function_name is never destroyed, because its refcount
-                                  greater than 1, classes are always destoyed in reverse order
-                                  and trait is declared early than this class */
+                                  greater than 1 and classes are always destoyed before the
+                                  traits they use */
                                fn_copy.common.function_name = aliases[i]->alias;
                                        
                                /* if it is 0, no modifieres has been changed */

diff --git a/Zend/zend_opcode.c b/Zend/zend_opcode.c
index 65fa85185ef869ce83bfa1ad020f37238c36ab40..19fd71e763d090e7974fe5311d62cbed7d4ac821 100644 (file)
--- a/Zend/zend_opcode.c
+++ b/Zend/zend_opcode.c
@@ -215,6 +215,12 @@ ZEND_API int zend_cleanup_class_data(zend_class_entry **pce TSRMLS_DC)
 void _destroy_zend_class_traits_info(zend_class_entry *ce)
 {
        if (ce->num_traits > 0 && ce->traits) {
+               size_t i;
+               for (i = 0; i < ce->num_traits; i++) {
+                       if (ce->traits[i]) {
+                               destroy_zend_class(&ce->traits[i]);
+                       }
+               }
                efree(ce->traits);
        }