Fixed bug #63635 (Segfault in gc_collect_cycles)

diff --git a/NEWS b/NEWS
index 08da27c53e66dfc2c72b0357646791b6b509761b..09b99955c66dbd82e016f2fb2eae7a32940a6506 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,7 @@ PHP                                                                        NEWS
 ?? ??? 2012, PHP 5.3.20
 
 - Zend Engine:
+  . Fixed bug #63635 (Segfault in gc_collect_cycles). (Dmitry)
   . Fixed bug #63512 (parse_ini_file() with INI_SCANNER_RAW removes quotes 
     from value). (Pierrick)
   . Fixed bug #63468 (wrong called method as callback with inheritance).

diff --git a/Zend/tests/bug63635.phpt b/Zend/tests/bug63635.phpt
new file mode 100644 (file)
index 0000000..6f6fc6a
--- /dev/null
+++ b/Zend/tests/bug63635.phpt
@@ -0,0 +1,58 @@
+--TEST--
+Bug #63635 (Segfault in gc_collect_cycles)
+--FILE--
+<?php
+class Node {
+       public $parent = NULL;
+       public $childs = array();
+       
+       function __construct(Node $parent=NULL) {
+               if ($parent) {
+                       $parent->childs[] = $this;
+               }
+               $this->childs[] = $this;
+       }
+       
+       function __destruct() {
+               $this->childs = NULL;
+       }       
+}
+
+define("MAX", 16);
+
+for ($n = 0; $n < 20; $n++) {
+       $top = new Node();
+       for ($i=0 ; $i<MAX ; $i++) {
+               $ci = new Node($top);
+               for ($j=0 ; $j<MAX ; $j++) {
+                       $cj = new Node($ci);
+                       for ($k=0 ; $k<MAX ; $k++) {
+                               $ck = new Node($cj);
+                       }
+               }
+       }
+       echo "$n\n";
+}
+echo "ok\n";
+--EXPECT--
+0
+1
+2
+3
+4
+5
+6
+7
+8
+9
+10
+11
+12
+13
+14
+15
+16
+17
+18
+19
+ok

diff --git a/Zend/zend_gc.c b/Zend/zend_gc.c
index 07031f066a2c755eeae8e32d89e0252cd409c2ee..2b27de80c0532c4f3daac80b2a31b8fa6a46c727 100644 (file)
--- a/Zend/zend_gc.c
+++ b/Zend/zend_gc.c
@@ -553,7 +553,8 @@ tail_call:
                        struct _store_object *obj = &EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].bucket.obj;
 
                        if (obj->buffered == (gc_root_buffer*)GC_WHITE) {
-                               GC_SET_BLACK(obj->buffered);
+                               /* PURPLE instead of BLACK to prevent buffering in nested gc calls */
+                               GC_SET_PURPLE(obj->buffered);
 
                                if (EXPECTED(EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].valid &&
                                             Z_OBJ_HANDLER_P(pz, get_properties) != NULL)) {
@@ -598,7 +599,8 @@ static void zobj_collect_white(zval *pz TSRMLS_DC)
                struct _store_object *obj = &EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].bucket.obj;
 
                if (obj->buffered == (gc_root_buffer*)GC_WHITE) {
-                       GC_SET_BLACK(obj->buffered);
+                       /* PURPLE instead of BLACK to prevent buffering in nested gc calls */
+                       GC_SET_PURPLE(obj->buffered);
 
                        if (EXPECTED(EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].valid &&
                                     Z_OBJ_HANDLER_P(pz, get_properties) != NULL)) {