Re-fixed bug #60825 (Segfault when running symfony 2 tests)

diff --git a/NEWS b/NEWS
index af94d7d21cf9381f4a2ba438517b066113f3e6e0..7047cad8241e15f9b97bb47bdaba87efbc60f181 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -8,7 +8,8 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #60573 (type hinting with "self" keyword causes weird errors).
     (Laruence)
-  . Fixed bug #60825 (Segfault when running symfony 2 tests). (Laruence)
+  . Fixed bug #60825 (Segfault when running symfony 2 tests).
+    (Dmitry, Laruence)
 
 - cURL:
   . Added support for CURLOPT_FTP_RESPONSE_TIMEOUT, CURLOPT_APPEND, 

diff --git a/Zend/tests/bug60825.phpt b/Zend/tests/bug60825.phpt
index dd22b71bae17797992eaf92b6b9475e06a091ea2..0aeb8f77e33b53aafb9b67c81bd683d0911d7898 100644 (file)
--- a/Zend/tests/bug60825.phpt
+++ b/Zend/tests/bug60825.phpt
@@ -4,15 +4,16 @@ Bug #60825 (Segfault when running symfony 2 tests)
 run this with valgrind
 --FILE--
 <?php
-if (isset($loaded)) {
-    $loaded = true;
-       class test {
-               public function __toString() {
-                       return __FILE__;
-               }
+class test {
+       public static $x;
+       public function __toString() {
+               self::$x = $this;
+               return __FILE__;
        }
-       $a = new test;
-       require_once $a;
 }
+$a = new test;
+require_once $a;
+debug_zval_dump(test::$x);
 ?>
---EXPECT--
+--EXPECTF--
+string(%d) "%sbug60825.php" refcount(2)

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index dc49b9217afa0bbdf03f87cdf51e5733eb245766..e2b487291f3f46fe237566a366e9693781d83a6e 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3693,17 +3693,18 @@ ZEND_VM_HANDLER(73, ZEND_INCLUDE_OR_EVAL, CONST|TMP|VAR|CV, ANY)
        zend_op_array *new_op_array=NULL;
        zend_free_op free_op1;
        zval *inc_filename;
-       zval tmp_inc_filename;
+    zval *tmp_inc_filename = NULL;
        zend_bool failure_retval=0;
 
        SAVE_OPLINE();
        inc_filename = GET_OP1_ZVAL_PTR(BP_VAR_R);
 
        if (inc_filename->type!=IS_STRING) {
-               INIT_PZVAL_COPY(&tmp_inc_filename, inc_filename);
-               zval_copy_ctor(&tmp_inc_filename);
-               convert_to_string(&tmp_inc_filename);
-               inc_filename = &tmp_inc_filename;
+               MAKE_STD_ZVAL(tmp_inc_filename);
+               ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename);
+               zval_copy_ctor(tmp_inc_filename);
+               convert_to_string(tmp_inc_filename);
+               inc_filename = tmp_inc_filename;
        }
 
        if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) {
@@ -3767,8 +3768,8 @@ ZEND_VM_HANDLER(73, ZEND_INCLUDE_OR_EVAL, CONST|TMP|VAR|CV, ANY)
                        EMPTY_SWITCH_DEFAULT_CASE()
                }
        }
-       if (inc_filename==&tmp_inc_filename) {
-               zval_dtor(&tmp_inc_filename);
+       if (tmp_inc_filename) {
+               zval_ptr_dtor(&tmp_inc_filename);
        }
        FREE_OP1();
        if (UNEXPECTED(EG(exception) != NULL)) {

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 59f3422a944d18e2f0ee5f2ecb6e9fedadb133f8..5289d7572264b8519ac3fc3d21e0f399410e26c0 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -2522,17 +2522,18 @@ static int ZEND_FASTCALL  ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER(ZEND_OPCODE_HA
        zend_op_array *new_op_array=NULL;
 
        zval *inc_filename;
-       zval tmp_inc_filename;
+    zval *tmp_inc_filename = NULL;
        zend_bool failure_retval=0;
 
        SAVE_OPLINE();
        inc_filename = opline->op1.zv;
 
        if (inc_filename->type!=IS_STRING) {
-               INIT_PZVAL_COPY(&tmp_inc_filename, inc_filename);
-               zval_copy_ctor(&tmp_inc_filename);
-               convert_to_string(&tmp_inc_filename);
-               inc_filename = &tmp_inc_filename;
+               MAKE_STD_ZVAL(tmp_inc_filename);
+               ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename);
+               zval_copy_ctor(tmp_inc_filename);
+               convert_to_string(tmp_inc_filename);
+               inc_filename = tmp_inc_filename;
        }
 
        if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) {
@@ -2596,8 +2597,8 @@ static int ZEND_FASTCALL  ZEND_INCLUDE_OR_EVAL_SPEC_CONST_HANDLER(ZEND_OPCODE_HA
                        EMPTY_SWITCH_DEFAULT_CASE()
                }
        }
-       if (inc_filename==&tmp_inc_filename) {
-               zval_dtor(&tmp_inc_filename);
+       if (tmp_inc_filename) {
+               zval_ptr_dtor(&tmp_inc_filename);
        }
 
        if (UNEXPECTED(EG(exception) != NULL)) {
@@ -6852,17 +6853,18 @@ static int ZEND_FASTCALL  ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER(ZEND_OPCODE_HAND
        zend_op_array *new_op_array=NULL;
        zend_free_op free_op1;
        zval *inc_filename;
-       zval tmp_inc_filename;
+    zval *tmp_inc_filename = NULL;
        zend_bool failure_retval=0;
 
        SAVE_OPLINE();
        inc_filename = _get_zval_ptr_tmp(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
 
        if (inc_filename->type!=IS_STRING) {
-               INIT_PZVAL_COPY(&tmp_inc_filename, inc_filename);
-               zval_copy_ctor(&tmp_inc_filename);
-               convert_to_string(&tmp_inc_filename);
-               inc_filename = &tmp_inc_filename;
+               MAKE_STD_ZVAL(tmp_inc_filename);
+               ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename);
+               zval_copy_ctor(tmp_inc_filename);
+               convert_to_string(tmp_inc_filename);
+               inc_filename = tmp_inc_filename;
        }
 
        if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) {
@@ -6926,8 +6928,8 @@ static int ZEND_FASTCALL  ZEND_INCLUDE_OR_EVAL_SPEC_TMP_HANDLER(ZEND_OPCODE_HAND
                        EMPTY_SWITCH_DEFAULT_CASE()
                }
        }
-       if (inc_filename==&tmp_inc_filename) {
-               zval_dtor(&tmp_inc_filename);
+       if (tmp_inc_filename) {
+               zval_ptr_dtor(&tmp_inc_filename);
        }
        zval_dtor(free_op1.var);
        if (UNEXPECTED(EG(exception) != NULL)) {
@@ -11209,17 +11211,18 @@ static int ZEND_FASTCALL  ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER(ZEND_OPCODE_HAND
        zend_op_array *new_op_array=NULL;
        zend_free_op free_op1;
        zval *inc_filename;
-       zval tmp_inc_filename;
+    zval *tmp_inc_filename = NULL;
        zend_bool failure_retval=0;
 
        SAVE_OPLINE();
        inc_filename = _get_zval_ptr_var(opline->op1.var, EX_Ts(), &free_op1 TSRMLS_CC);
 
        if (inc_filename->type!=IS_STRING) {
-               INIT_PZVAL_COPY(&tmp_inc_filename, inc_filename);
-               zval_copy_ctor(&tmp_inc_filename);
-               convert_to_string(&tmp_inc_filename);
-               inc_filename = &tmp_inc_filename;
+               MAKE_STD_ZVAL(tmp_inc_filename);
+               ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename);
+               zval_copy_ctor(tmp_inc_filename);
+               convert_to_string(tmp_inc_filename);
+               inc_filename = tmp_inc_filename;
        }
 
        if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) {
@@ -11283,8 +11286,8 @@ static int ZEND_FASTCALL  ZEND_INCLUDE_OR_EVAL_SPEC_VAR_HANDLER(ZEND_OPCODE_HAND
                        EMPTY_SWITCH_DEFAULT_CASE()
                }
        }
-       if (inc_filename==&tmp_inc_filename) {
-               zval_dtor(&tmp_inc_filename);
+       if (tmp_inc_filename) {
+               zval_ptr_dtor(&tmp_inc_filename);
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        if (UNEXPECTED(EG(exception) != NULL)) {
@@ -27061,17 +27064,18 @@ static int ZEND_FASTCALL  ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER(ZEND_OPCODE_HANDL
        zend_op_array *new_op_array=NULL;
 
        zval *inc_filename;
-       zval tmp_inc_filename;
+    zval *tmp_inc_filename = NULL;
        zend_bool failure_retval=0;
 
        SAVE_OPLINE();
        inc_filename = _get_zval_ptr_cv_BP_VAR_R(EX_CVs(), opline->op1.var TSRMLS_CC);
 
        if (inc_filename->type!=IS_STRING) {
-               INIT_PZVAL_COPY(&tmp_inc_filename, inc_filename);
-               zval_copy_ctor(&tmp_inc_filename);
-               convert_to_string(&tmp_inc_filename);
-               inc_filename = &tmp_inc_filename;
+               MAKE_STD_ZVAL(tmp_inc_filename);
+               ZVAL_COPY_VALUE(tmp_inc_filename, inc_filename);
+               zval_copy_ctor(tmp_inc_filename);
+               convert_to_string(tmp_inc_filename);
+               inc_filename = tmp_inc_filename;
        }
 
        if (opline->extended_value != ZEND_EVAL && strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename)) {
@@ -27135,8 +27139,8 @@ static int ZEND_FASTCALL  ZEND_INCLUDE_OR_EVAL_SPEC_CV_HANDLER(ZEND_OPCODE_HANDL
                        EMPTY_SWITCH_DEFAULT_CASE()
                }
        }
-       if (inc_filename==&tmp_inc_filename) {
-               zval_dtor(&tmp_inc_filename);
+       if (tmp_inc_filename) {
+               zval_ptr_dtor(&tmp_inc_filename);
        }
 
        if (UNEXPECTED(EG(exception) != NULL)) {