Fixed bug #47343 (gc_collect_cycles causes a segfault when called within a destructor...

diff --git a/Zend/tests/bug47343.phpt b/Zend/tests/bug47343.phpt
new file mode 100644 (file)
index 0000000..07a3b4e
--- /dev/null
+++ b/Zend/tests/bug47343.phpt
@@ -0,0 +1,44 @@
+--TEST--
+Bug #47343 (gc_collect_cycles causes a segfault when called within a destructor in one case)
+--FILE--
+<?php
+class A
+{
+       public function __destruct()
+       {
+               gc_collect_cycles();
+       }
+       
+       public function getB()
+       {
+               $this->data['foo'] = new B($this);
+               $this->data['bar'] = new B($this);
+               // Return either of the above
+               return $this->data['foo'];
+       }
+}
+
+class B
+{
+       public function B($A)
+       {
+               $this->A = $A;
+       }
+
+       public function __destruct()
+       {
+       }
+}
+
+for ($i = 0; $i < 2; $i++)
+{
+       $Aobj = new A;
+       $Bobj = $Aobj->getB();
+       unset($Bobj);
+       unset($Aobj);
+}
+
+echo "DONE\n";
+?>
+--EXPECT--
+DONE

diff --git a/Zend/zend_gc.c b/Zend/zend_gc.c
index 4f6616c920ded26ac0681a21c68c111b0115e1db..95a4ac846cf7db11580f92aa5789a0bc67b3467b 100644 (file)
--- a/Zend/zend_gc.c
+++ b/Zend/zend_gc.c
@@ -521,7 +521,7 @@ static void gc_collect_roots(TSRMLS_D)
        }
 }
 
-#define FREE_LIST_END ((zval_gc_info*)((-1)|~GC_COLOR))
+#define FREE_LIST_END ((zval_gc_info*)(~(zend_uintptr_t)GC_COLOR))
 
 ZEND_API int gc_collect_cycles(TSRMLS_D)
 {