Fixed bug #54585 (track_errors causes segfault)

diff --git a/Zend/tests/bug54585.phpt b/Zend/tests/bug54585.phpt
new file mode 100644 (file)
index 0000000..2ca11f3
--- /dev/null
+++ b/Zend/tests/bug54585.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #54585 (track_errors causes segfault)
+--INI--
+track_errors=On
+--FILE--
+<?php
+function testing($source) {
+                unset($source[$cos]);
+}
+testing($_GET);
+echo "ok\n";
+?>
+--EXPECTF--
+Notice: Undefined variable: cos in %sbug54585.php on line 3
+ok

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 8b8e3450b5a4d4106ec37d235e5835d79b614d0d..9c6199345a3b8de90135a5cf322592bab7d02698 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3835,12 +3835,12 @@ ZEND_VM_HANDLER(75, ZEND_UNSET_DIM, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
 
        SAVE_OPLINE();
        container = GET_OP1_OBJ_ZVAL_PTR_PTR(BP_VAR_UNSET);
+       if (OP1_TYPE == IS_CV && container != &EG(uninitialized_zval_ptr)) {
+               SEPARATE_ZVAL_IF_NOT_REF(container);
+       }
        offset = GET_OP2_ZVAL_PTR(BP_VAR_R);
 
        if (OP1_TYPE != IS_VAR || container) {
-               if (OP1_TYPE == IS_CV && container != &EG(uninitialized_zval_ptr)) {
-                       SEPARATE_ZVAL_IF_NOT_REF(container);
-               }
                switch (Z_TYPE_PP(container)) {
                        case IS_ARRAY: {
                                HashTable *ht = Z_ARRVAL_PP(container);

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 001c5295e8fc204df9bbf67bd4a1dd6a7b3a3aa7..2c909be86dd11f8f1d7aecbee267df48b4fb2cb2 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -13275,12 +13275,12 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HAND
 
        SAVE_OPLINE();
        container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
+       if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
+               SEPARATE_ZVAL_IF_NOT_REF(container);
+       }
        offset = opline->op2.zv;
 
        if (IS_VAR != IS_VAR || container) {
-               if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
-                       SEPARATE_ZVAL_IF_NOT_REF(container);
-               }
                switch (Z_TYPE_PP(container)) {
                        case IS_ARRAY: {
                                HashTable *ht = Z_ARRVAL_PP(container);
@@ -15259,12 +15259,12 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLE
 
        SAVE_OPLINE();
        container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
+       if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
+               SEPARATE_ZVAL_IF_NOT_REF(container);
+       }
        offset = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
 
        if (IS_VAR != IS_VAR || container) {
-               if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
-                       SEPARATE_ZVAL_IF_NOT_REF(container);
-               }
                switch (Z_TYPE_PP(container)) {
                        case IS_ARRAY: {
                                HashTable *ht = Z_ARRVAL_PP(container);
@@ -17439,12 +17439,12 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLE
 
        SAVE_OPLINE();
        container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
+       if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
+               SEPARATE_ZVAL_IF_NOT_REF(container);
+       }
        offset = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
 
        if (IS_VAR != IS_VAR || container) {
-               if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
-                       SEPARATE_ZVAL_IF_NOT_REF(container);
-               }
                switch (Z_TYPE_PP(container)) {
                        case IS_ARRAY: {
                                HashTable *ht = Z_ARRVAL_PP(container);
@@ -20431,12 +20431,12 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER
 
        SAVE_OPLINE();
        container = _get_zval_ptr_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
+       if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
+               SEPARATE_ZVAL_IF_NOT_REF(container);
+       }
        offset = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
 
        if (IS_VAR != IS_VAR || container) {
-               if (IS_VAR == IS_CV && container != &EG(uninitialized_zval_ptr)) {
-                       SEPARATE_ZVAL_IF_NOT_REF(container);
-               }
                switch (Z_TYPE_PP(container)) {
                        case IS_ARRAY: {
                                HashTable *ht = Z_ARRVAL_PP(container);
@@ -21753,12 +21753,12 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_H
 
        SAVE_OPLINE();
        container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
+       if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
+               SEPARATE_ZVAL_IF_NOT_REF(container);
+       }
        offset = opline->op2.zv;
 
        if (IS_UNUSED != IS_VAR || container) {
-               if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
-                       SEPARATE_ZVAL_IF_NOT_REF(container);
-               }
                switch (Z_TYPE_PP(container)) {
                        case IS_ARRAY: {
                                HashTable *ht = Z_ARRVAL_PP(container);
@@ -22896,12 +22896,12 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HAN
 
        SAVE_OPLINE();
        container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
+       if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
+               SEPARATE_ZVAL_IF_NOT_REF(container);
+       }
        offset = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
 
        if (IS_UNUSED != IS_VAR || container) {
-               if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
-                       SEPARATE_ZVAL_IF_NOT_REF(container);
-               }
                switch (Z_TYPE_PP(container)) {
                        case IS_ARRAY: {
                                HashTable *ht = Z_ARRVAL_PP(container);
@@ -24039,12 +24039,12 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HAN
 
        SAVE_OPLINE();
        container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
+       if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
+               SEPARATE_ZVAL_IF_NOT_REF(container);
+       }
        offset = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
 
        if (IS_UNUSED != IS_VAR || container) {
-               if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
-                       SEPARATE_ZVAL_IF_NOT_REF(container);
-               }
                switch (Z_TYPE_PP(container)) {
                        case IS_ARRAY: {
                                HashTable *ht = Z_ARRVAL_PP(container);
@@ -25448,12 +25448,12 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HAND
 
        SAVE_OPLINE();
        container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C);
+       if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
+               SEPARATE_ZVAL_IF_NOT_REF(container);
+       }
        offset = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
 
        if (IS_UNUSED != IS_VAR || container) {
-               if (IS_UNUSED == IS_CV && container != &EG(uninitialized_zval_ptr)) {
-                       SEPARATE_ZVAL_IF_NOT_REF(container);
-               }
                switch (Z_TYPE_PP(container)) {
                        case IS_ARRAY: {
                                HashTable *ht = Z_ARRVAL_PP(container);
@@ -28595,12 +28595,12 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDL
 
        SAVE_OPLINE();
        container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
+       if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
+               SEPARATE_ZVAL_IF_NOT_REF(container);
+       }
        offset = opline->op2.zv;
 
        if (IS_CV != IS_VAR || container) {
-               if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
-                       SEPARATE_ZVAL_IF_NOT_REF(container);
-               }
                switch (Z_TYPE_PP(container)) {
                        case IS_ARRAY: {
                                HashTable *ht = Z_ARRVAL_PP(container);
@@ -30453,12 +30453,12 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER
 
        SAVE_OPLINE();
        container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
+       if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
+               SEPARATE_ZVAL_IF_NOT_REF(container);
+       }
        offset = _get_zval_ptr_tmp(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
 
        if (IS_CV != IS_VAR || container) {
-               if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
-                       SEPARATE_ZVAL_IF_NOT_REF(container);
-               }
                switch (Z_TYPE_PP(container)) {
                        case IS_ARRAY: {
                                HashTable *ht = Z_ARRVAL_PP(container);
@@ -32506,12 +32506,12 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER
 
        SAVE_OPLINE();
        container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
+       if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
+               SEPARATE_ZVAL_IF_NOT_REF(container);
+       }
        offset = _get_zval_ptr_var(opline->op2.var, EX_Ts(), &free_op2 TSRMLS_CC);
 
        if (IS_CV != IS_VAR || container) {
-               if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
-                       SEPARATE_ZVAL_IF_NOT_REF(container);
-               }
                switch (Z_TYPE_PP(container)) {
                        case IS_ARRAY: {
                                HashTable *ht = Z_ARRVAL_PP(container);
@@ -35235,12 +35235,12 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_
 
        SAVE_OPLINE();
        container = _get_zval_ptr_ptr_cv_BP_VAR_UNSET(EX_CVs(), opline->op1.var TSRMLS_CC);
+       if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
+               SEPARATE_ZVAL_IF_NOT_REF(container);
+       }
        offset = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op2.var TSRMLS_CC);
 
        if (IS_CV != IS_VAR || container) {
-               if (IS_CV == IS_CV && container != &EG(uninitialized_zval_ptr)) {
-                       SEPARATE_ZVAL_IF_NOT_REF(container);
-               }
                switch (Z_TYPE_PP(container)) {
                        case IS_ARRAY: {
                                HashTable *ht = Z_ARRVAL_PP(container);