Prevented crash in GC because of incorrect reference counting

diff --git a/Zend/tests/gc_032.phpt b/Zend/tests/gc_032.phpt
new file mode 100644 (file)
index 0000000..615b008
--- /dev/null
+++ b/Zend/tests/gc_032.phpt
@@ -0,0 +1,40 @@
+--TEST--
+GC 032: Crash in GC because of invalid reference counting
+--FILE--
+<?php
+$a = array();
+$b =& $a;
+$a[0] = $a;
+debug_zval_dump($a);
+$a = array(array());
+$b =& $a;
+$a[0][0] = $a;
+debug_zval_dump($a);
+?>
+--EXPECT--
+array(1) refcount(1){
+  [0]=>
+  array(1) refcount(3){
+    [0]=>
+    array(1) refcount(3){
+      [0]=>
+      *RECURSION*
+    }
+  }
+}
+array(1) refcount(1){
+  [0]=>
+  array(1) refcount(3){
+    [0]=>
+    array(1) refcount(1){
+      [0]=>
+      array(1) refcount(3){
+        [0]=>
+        array(1) refcount(1){
+          [0]=>
+          *RECURSION*
+        }
+      }
+    }
+  }
+}

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 5ddb03a8c35e142375dfceb80884bb9b0365a584..2d9a8cdd58317e5757a8c4a54f02330e6b3d8b3c 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -714,8 +714,8 @@ static inline zval* zend_assign_to_variable(zval **variable_ptr_ptr, zval *value
                                        ALLOC_ZVAL(variable_ptr);
                                        *variable_ptr_ptr = variable_ptr;
                                        *variable_ptr = *value;
-                                       zval_copy_ctor(variable_ptr);
                                        Z_SET_REFCOUNT_P(variable_ptr, 1);
+                                       zval_copy_ctor(variable_ptr);
                                } else {
                                        *variable_ptr_ptr = value;
                                        Z_ADDREF_P(value);