Fixed bug #38315 (Constructing in the destructor causes weird behaviour)

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 80ab3d5298f8d917123aa40f8413712c40ad675e..3e0c07390af580f0ecf79c2d9944492f7dc534b0 100644 (file)
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -660,15 +660,6 @@ static Bucket *zend_hash_apply_deleter(HashTable *ht, Bucket *p)
        Bucket *retval;
 
        HANDLE_BLOCK_INTERRUPTIONS();
-
-       if (ht->pDestructor) {
-               ht->pDestructor(p->pData);
-       }
-       if (p->pData != &p->pDataPtr) {
-               pefree(p->pData, ht->persistent);
-       }
-       retval = p->pListNext;
-
        if (p->pLast) {
                p->pLast->pNext = p->pNext;
        } else {
@@ -697,9 +688,17 @@ static Bucket *zend_hash_apply_deleter(HashTable *ht, Bucket *p)
        if (ht->pInternalPointer == p) {
                ht->pInternalPointer = p->pListNext;
        }
-       pefree(p, ht->persistent);
-       HANDLE_UNBLOCK_INTERRUPTIONS();
        ht->nNumOfElements--;
+       HANDLE_UNBLOCK_INTERRUPTIONS();
+
+       if (ht->pDestructor) {
+               ht->pDestructor(p->pData);
+       }
+       if (p->pData != &p->pDataPtr) {
+               pefree(p->pData, ht->persistent);
+       }
+       retval = p->pListNext;
+       pefree(p, ht->persistent);
 
        return retval;
 }