Fixed bug #30707 (Segmentation fault on exception in method)

diff --git a/Zend/tests/bug30707.phpt b/Zend/tests/bug30707.phpt
new file mode 100755 (executable)
index 0000000..d37d329
--- /dev/null
+++ b/Zend/tests/bug30707.phpt
@@ -0,0 +1,29 @@
+--TEST--
+Bug #30707 (Segmentation fault on exception in method)
+--FILE--
+<?php
+class C {
+       function byePHP($plop) {
+               echo "ok\n";
+       }
+
+       function plip() {
+               try {
+                       $this->plap($this->plop());
+               }       catch(Exception $e) {
+               }
+       }
+
+       function plap($a) {     
+       }
+
+       function plop() {
+               throw new Exception;
+       }
+}
+
+$x = new C;
+$x->byePHP($x->plip());
+?>
+--EXPECT--
+ok

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 8aca967119a8930fcdf593efe80f306f056dd814..638cec2b37067bbe5accdd0bcaa0d4c4fea0fbf4 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3506,6 +3506,13 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY)
                }
        }
 
+       while (EX(fbc)) {
+               if (EX(object)) {
+                       zval_ptr_dtor(&EX(object));
+               }
+               zend_ptr_stack_n_pop(&EG(arg_types_stack), 3, &EX(calling_scope), &EX(object), &EX(fbc));
+       }
+
        if (encapsulating_block == -1) {
                ZEND_VM_RETURN_FROM_EXECUTE_LOOP();
        } else {

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index cdbe7596b4b41ccb9fbe426a3090b0fb4c8a1489..13ecdab0d99addaf92c973a7137de3807eb11e8d 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -491,6 +491,13 @@ static int ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                }
        }
 
+       while (EX(fbc)) {
+               if (EX(object)) {
+                       zval_ptr_dtor(&EX(object));
+               }
+               zend_ptr_stack_n_pop(&EG(arg_types_stack), 3, &EX(calling_scope), &EX(object), &EX(fbc));
+       }
+
        if (encapsulating_block == -1) {
                ZEND_VM_RETURN_FROM_EXECUTE_LOOP();
        } else {
@@ -32441,6 +32448,13 @@ static int ZEND_HANDLE_EXCEPTION_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                }
        }
 
+       while (EX(fbc)) {
+               if (EX(object)) {
+                       zval_ptr_dtor(&EX(object));
+               }
+               zend_ptr_stack_n_pop(&EG(arg_types_stack), 3, &EX(calling_scope), &EX(object), &EX(fbc));
+       }
+
        if (encapsulating_block == -1) {
                ZEND_VM_RETURN_FROM_EXECUTE_LOOP();
        } else {