- Real fix for bug #27535 (Dmitry)

diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c
index d372d3d960370706a828a9439c53482808c7eda4..0718aaa197491a461245aa15ba6f02437368c35b 100644 (file)
--- a/Zend/zend_objects_API.c
+++ b/Zend/zend_objects_API.c
@@ -69,6 +69,7 @@ ZEND_API void zend_objects_store_free_object_storage(zend_objects_store *objects
                        if (obj->free_storage) {
                                obj->free_storage(obj->object TSRMLS_CC);
                        }
+                       /* Not adding to free list as we are shutting down anyway */
                }
        }
 }
@@ -128,25 +129,28 @@ ZEND_API void zend_objects_store_del_ref(zval *zobject TSRMLS_DC)
        zend_object_handle handle = Z_OBJ_HANDLE_P(zobject);
        struct _store_object *obj = &EG(objects_store).object_buckets[handle].bucket.obj;
        
-                       /*      Make sure we hold a reference count during the destructor call
-                               otherwise, when the destructor ends the storage might be freed
-                               when the refcount reaches 0 a second time
-                       */
-       if (obj->refcount == 1) {
-               if (!EG(objects_store).object_buckets[handle].destructor_called) {
-                       EG(objects_store).object_buckets[handle].destructor_called = 1;
-
-                       if (obj->dtor) {
-                               obj->dtor(obj->object, handle TSRMLS_CC);
-                       }
-               }
+       /*      Make sure we hold a reference count during the destructor call
+               otherwise, when the destructor ends the storage might be freed
+               when the refcount reaches 0 a second time
+       */
+       if (EG(objects_store).object_buckets[handle].valid) {
                if (obj->refcount == 1) {
-                       if (obj->free_storage && EG(objects_store).object_buckets[handle].valid) {
-                               obj->free_storage(obj->object TSRMLS_CC);
+                       if (!EG(objects_store).object_buckets[handle].destructor_called) {
+                               EG(objects_store).object_buckets[handle].destructor_called = 1;
+
+                               if (obj->dtor) {
+                                       obj->dtor(obj->object, handle TSRMLS_CC);
+                               }
+                       }
+                       if (obj->refcount == 1) {
+                               if (obj->free_storage) {
+                                       obj->free_storage(obj->object TSRMLS_CC);
+                               }
+                               ZEND_OBJECTS_STORE_ADD_TO_FREE_LIST();
                        }
-                       ZEND_OBJECTS_STORE_ADD_TO_FREE_LIST();
                }
        }
+
        obj->refcount--;
 
 #if ZEND_DEBUG_OBJECTS