fix #41026 (segfault when calling "self::method()" in shutdown functions)

diff --git a/Zend/tests/bug41026.phpt b/Zend/tests/bug41026.phpt
new file mode 100644 (file)
index 0000000..7caac21
--- /dev/null
+++ b/Zend/tests/bug41026.phpt
@@ -0,0 +1,26 @@
+--TEST--
+Bug #41026 (segfault when calling "self::method()" in shutdown functions)
+--FILE--
+<?php
+
+class try_class
+{
+       static public function main ()
+       {
+               register_shutdown_function (array ("self", "on_shutdown"));
+       }
+
+       static public function on_shutdown ()
+       {
+               printf ("CHECKPOINT\n"); /* never reached */
+       }
+}
+
+try_class::main ();
+
+echo "Done\n";
+?>
+--EXPECTF--    
+Done
+
+Warning: (Registered shutdown functions) Unable to call self::on_shutdown() - function does not exist in Unknown on line 0

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index 1524031deede9ff5e595dff021812352ac3fc3d9..d3f58f660e1e62ed4326013e058412269c3c9e8e 100644 (file)
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -2262,9 +2262,9 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, uint check_flags, char **
                                                }
 
                                                lcname = zend_str_tolower_dup(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj));
-                                               if (Z_STRLEN_PP(obj) == sizeof("self") - 1 && memcmp(lcname, "self", sizeof("self")) == 0) {
+                                               if (Z_STRLEN_PP(obj) == sizeof("self") - 1 && memcmp(lcname, "self", sizeof("self")) == 0 && EG(active_op_array)) {
                                                        ce = EG(active_op_array)->scope;
-                                               } else if (Z_STRLEN_PP(obj) == sizeof("parent") - 1 && memcmp(lcname, "parent", sizeof("parent")) == 0 && EG(active_op_array)->scope) {
+                                               } else if (Z_STRLEN_PP(obj) == sizeof("parent") - 1 && memcmp(lcname, "parent", sizeof("parent")) == 0 && EG(active_op_array) && EG(active_op_array)->scope) {
                                                        ce = EG(active_op_array)->scope->parent;
                                                } else if (zend_lookup_class(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj), &pce TSRMLS_CC) == SUCCESS) {
                                                        ce = *pce;