Fixed bug #71930 (_zval_dtor_func: Assertion `(arr)->gc.refcount <= 1' failed)

diff --git a/NEWS b/NEWS
index b81998b5d26fe5dea1fff0ef44d6baab242a740a..f86d7b2588fac439bfca9fd57ccb4a87e0ee8e0b 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? ??? 2016 PHP 7.0.6
 
 - Core:
+  . Fixed bug #71930 (_zval_dtor_func: Assertion `(arr)->gc.refcount <= 1'
+    failed). (Laruence)
   . Fixed bug #71914 (Reference is lost in "switch"). (Laruence)
   . Fixed Bug #71859 (zend_objects_store_call_destructors operates on realloced
     memory, crashing). (Laruence)

diff --git a/Zend/tests/bug71930.phpt b/Zend/tests/bug71930.phpt
new file mode 100644 (file)
index 0000000..4604b88
--- /dev/null
+++ b/Zend/tests/bug71930.phpt
@@ -0,0 +1,30 @@
+--TEST--
+Bug #71930 (_zval_dtor_func: Assertion `(arr)->gc.refcount <= 1' failed)
+--SKIPIF--
+<?php
+if (!extension_loaded("curl")) {
+  die("skip Require a resource which is able to hold a callbck");
+}
+?>
+--FILE--
+<?php
+
+class A {
+       public static function dummy() {
+       }
+}
+
+$a = array();
+$a[] = "A";
+$a[] = "dummy";
+
+$ch1 = curl_init();
+curl_setopt($ch1, CURLOPT_HEADERFUNCTION, $a);
+
+set_error_handler($a);
+set_error_handler(function()use($ch1){});
+set_error_handler(function(){});
+?>
+okey
+--EXPECT--
+okey

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 650f0a1e524ec029bc2f6b7605fcc277360c5c7d..bdb9bb7bd5a48e58fa44c8808a796a0049fcb7e6 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -295,8 +295,8 @@ void shutdown_executor(void) /* {{{ */
                }
 
                zend_stack_clean(&EG(user_error_handlers_error_reporting), NULL, 1);
-               zend_stack_clean(&EG(user_error_handlers), (void (*)(void *))ZVAL_DESTRUCTOR, 1);
-               zend_stack_clean(&EG(user_exception_handlers), (void (*)(void *))ZVAL_DESTRUCTOR, 1);
+               zend_stack_clean(&EG(user_error_handlers), (void (*)(void *))ZVAL_PTR_DTOR, 1);
+               zend_stack_clean(&EG(user_exception_handlers), (void (*)(void *))ZVAL_PTR_DTOR, 1);
        } zend_end_try();
 
        zend_try {