Fixed bug #36006 (Problem with $this in __destruct())

diff --git a/NEWS b/NEWS
index 95a8902c89c0769412f9ae0704e6845c2d1be5df..78b216729b57c11a0f8d575a0cd6aa2f40546948 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,7 @@ PHP                                                                        NEWS
 - Fixed bug #36016 (realpath cache memleaks). (Dmitry, Nuno)
 - Fixed bug #36011 (Strict errormsg wrong for call_user_func() and the likes).
   (Marcus)
+- Fixed bug #36006 (Problem with $this in __destruct()). (Dmitry)
 - Fixed bug #35998 (SplFileInfo::getPathname() returns unix style filenames
   in win32). (Marcus)
 

diff --git a/Zend/tests/bug36006.phpt b/Zend/tests/bug36006.phpt
new file mode 100755 (executable)
index 0000000..79f9897
--- /dev/null
+++ b/Zend/tests/bug36006.phpt
@@ -0,0 +1,30 @@
+--TEST--
+Bug #36006 (Problem with $this in __destruct())
+--FILE--
+<?php
+
+class Person {
+       public $dad;
+       public function __destruct() {
+               $this->dad = null; /* no segfault if this is commented out */
+       }
+}
+
+class Dad extends Person {
+       public $son;
+       public function __construct() {
+               $this->son = new Person;
+               $this->son->dad = $this; /* no segfault if this is commented out */
+       }
+       public function __destruct() {
+               $this->son = null;
+               parent::__destruct(); /* segfault here */
+       }
+}
+
+$o = new Dad;
+unset($o);
+echo "ok\n";
+?>
+--EXPECT--
+ok

diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c
index c47125de3dbb57c0465a4fada1fa1e099c55a66b..0926c744c47adba09759b2d9406fe253dad9d657 100644 (file)
--- a/Zend/zend_objects_API.c
+++ b/Zend/zend_objects_API.c
@@ -52,7 +52,9 @@ ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects TS
                        if (!objects->object_buckets[i].destructor_called) {
                                objects->object_buckets[i].destructor_called = 1;
                                if (obj->dtor && obj->object) {
+                                       obj->refcount++;
                                        obj->dtor(obj->object, i TSRMLS_CC);
+                                       obj->refcount--;
                                }
                        }
                }