- Actually the destructor should run after the data is already detached

  from the hash but before the bucket is freed.

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index b1a952dacec5bd77ae1b4026f24dd4ce9abb832d..b25b732bc04b97960e09ce5929ff3b4e9772695c 100644 (file)
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -537,9 +537,6 @@ ZEND_API int zend_hash_del_key_or_index(HashTable *ht, char *arKey, uint nKeyLen
                if ((p->h == h) && ((p->nKeyLength == 0) || /* Numeric index */
                        ((p->nKeyLength == nKeyLength) && (!memcmp(p->arKey, arKey, nKeyLength))))) {
                        HANDLE_BLOCK_INTERRUPTIONS();
-                       if (ht->pDestructor) {
-                               ht->pDestructor(p->pData);
-                       }
                        if (p == ht->arBuckets[nIndex]) {
                                ht->arBuckets[nIndex] = p->pNext;
                        } else {
@@ -562,6 +559,9 @@ ZEND_API int zend_hash_del_key_or_index(HashTable *ht, char *arKey, uint nKeyLen
                        if (ht->pInternalPointer == p) {
                                ht->pInternalPointer = p->pListNext;
                        }
+                       if (ht->pDestructor) {
+                               ht->pDestructor(p->pData);
+                       }
                        pefree(p,ht->persistent);
                        HANDLE_UNBLOCK_INTERRUPTIONS();
                        ht->nNumOfElements--;