Fix bug #70179 ($this refcount issue)

diff --git a/NEWS b/NEWS
index 39a4b62da68f15aa5dc50d09efc6a06fb2f0eb51..5ad80828601002a27bca74d8cccbcacef0af58e4 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -11,8 +11,9 @@ PHP                                                                        NEWS
   . Fixed bug #70106 (Inheritance by anonymous class). (Bob)
   . Fixed bug #69674 (SIGSEGV array.c:953). (cmb)
   . Fixed bug #70164 (__COMPILER_HALT_OFFSET__ under namespace is not defined).
-    (Bob))
-  . Fixed Bug #70108 (sometimes empty $_SERVER['QUERY_STRING']). (Anatol)
+    (Bob)
+  . Fixed bug #70108 (sometimes empty $_SERVER['QUERY_STRING']). (Anatol)
+  . Fixed bug #70179 ($this refcount issue). (Bob)
 
 - Curl:
   . Fixed bug #70163 (curl_setopt_array() type confusion). (Laruence)

diff --git a/Zend/tests/bug70179.phpt b/Zend/tests/bug70179.phpt
new file mode 100644 (file)
index 0000000..a5bdb98
--- /dev/null
+++ b/Zend/tests/bug70179.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #70179 ($this refcount issue)
+--FILE--
+<?php
+
+class X {
+       function __invoke() {
+               var_dump($this);
+       }
+}
+(new X)();
+
+?>
+--EXPECT--
+object(X)#1 (0) {
+}

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index f77e495fa2abaf7201d8e4e0e4deb24eac3d585e..8537a6a178f8d4b6b582c5b4789776c5b0f5900c 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3250,6 +3250,9 @@ ZEND_VM_C_LABEL(try_function_name):
                        ZEND_ASSERT(GC_TYPE(fbc->common.prototype) == IS_OBJECT);
                        GC_REFCOUNT(fbc->common.prototype)++;
                        call_info |= ZEND_CALL_CLOSURE;
+               } else {
+                       call_info |= ZEND_CALL_RELEASE_THIS;
+                       GC_REFCOUNT(object)++; /* For $this pointer */
                }
                FREE_OP2();
        } else if (EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) &&

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 950353c9a2cee8e4870ce358e791c672a05d84c2..527de7d1967af7087738344697ec6d0eca9fab46 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -2019,6 +2019,9 @@ try_function_name:
                        ZEND_ASSERT(GC_TYPE(fbc->common.prototype) == IS_OBJECT);
                        GC_REFCOUNT(fbc->common.prototype)++;
                        call_info |= ZEND_CALL_CLOSURE;
+               } else {
+                       call_info |= ZEND_CALL_RELEASE_THIS;
+                       GC_REFCOUNT(object)++; /* For $this pointer */
                }
 
        } else if (EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) &&
@@ -2438,6 +2441,9 @@ try_function_name:
                        ZEND_ASSERT(GC_TYPE(fbc->common.prototype) == IS_OBJECT);
                        GC_REFCOUNT(fbc->common.prototype)++;
                        call_info |= ZEND_CALL_CLOSURE;
+               } else {
+                       call_info |= ZEND_CALL_RELEASE_THIS;
+                       GC_REFCOUNT(object)++; /* For $this pointer */
                }
 
        } else if (EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) &&
@@ -2690,6 +2696,9 @@ try_function_name:
                        ZEND_ASSERT(GC_TYPE(fbc->common.prototype) == IS_OBJECT);
                        GC_REFCOUNT(fbc->common.prototype)++;
                        call_info |= ZEND_CALL_CLOSURE;
+               } else {
+                       call_info |= ZEND_CALL_RELEASE_THIS;
+                       GC_REFCOUNT(object)++; /* For $this pointer */
                }
                zval_ptr_dtor_nogc(free_op2);
        } else if (EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) &&