Fixed bug #50723 (Bug in garbage collector causes crash)

diff --git a/NEWS b/NEWS
index d7e7c3254d99748192f9e998a57eaf863e26693e..f770d58e24d1ead2fcff900e96566e7d8e92ccf4 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -39,6 +39,7 @@ PHP                                                                        NEWS
 - Fixed bug #50732 (exec() adds single byte twice to $output array). (Ilia)
 - Fixed bug #50728 (All PDOExceptions hardcode 'code' property to 0).
   (Joey, Ilia)
+- Fixed bug #50723 (Bug in garbage collector causes crash). (Dmitry)
 - Fixed bug #50690 (putenv does not set ENV when the value is only one char).
   (Pierre)
 - Fixed bug #50680 (strtotime() does not support eighth ordinal number). (Ilia)

diff --git a/Zend/zend_execute.h b/Zend/zend_execute.h
index dcbe93aa107c21327d779c2efabc3e48f19548eb..be493cac19510e796d23198553a83d72135e543e 100644 (file)
--- a/Zend/zend_execute.h
+++ b/Zend/zend_execute.h
@@ -228,7 +228,7 @@ static inline void *zend_vm_stack_alloc(size_t size TSRMLS_DC)
                int extra = (ZEND_MM_ALIGNMENT - ((zend_uintptr_t)EG(argument_stack)->top & (ZEND_MM_ALIGNMENT - 1))) / sizeof(void*);
 
                if (UNEXPECTED(size + extra + ZEND_MM_ALIGNED_SIZE(sizeof(void*)) / sizeof(void*) >
-                   (zend_uintptr_t)EG(argument_stack)->end - (zend_uintptr_t)EG(argument_stack)->top)) {
+                   (zend_uintptr_t)(EG(argument_stack)->end - EG(argument_stack)->top))) {
                        zend_vm_stack_extend(size TSRMLS_CC);
                } else {
                        void **old_top = EG(argument_stack)->top;