Fixed bug #78986

Don't assume that handlers live in the arena, they may also be in
SHM.

diff --git a/NEWS b/NEWS
index 39bdee3618111ea3ff9fd86b1ed6a69931280639..4143c8cb9c9124f708f1d6a904788d6bf1526beb 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,8 @@ PHP                                                                        NEWS
   . Fixed bug #78950 (Preloading trait method with static variables). (Nikita)
   . Fixed bug #78903 (Conflict in RTD key for closures results in crash).
     (Nikita)
+  . Fixed bug #78986 (Opcache segfaults when inheriting ctor from immutable
+    into mutable class). (Nikita)
 
 - Spl:
   . Fixed bug #78976 (SplFileObject::fputcsv returns -1 on failure). (cmb)

diff --git a/ext/opcache/tests/bug78986.phpt b/ext/opcache/tests/bug78986.phpt
new file mode 100644 (file)
index 0000000..9479460
--- /dev/null
+++ b/ext/opcache/tests/bug78986.phpt
@@ -0,0 +1,28 @@
+--TEST--
+Bug #78986: Opcache segfaults when inheriting ctor from immutable into mutable class
+--FILE--
+<?php
+
+define('TEST_TEST', 1);
+
+class TestClass2 {
+    function __construct() {}
+}
+
+class TestClass extends TestClass2 {
+    var $test = [
+        TEST_TEST => 'test'  
+    ];
+}
+
+var_dump(new TestClass());
+
+?>
+--EXPECT--
+object(TestClass)#1 (1) {
+  ["test"]=>
+  array(1) {
+    [1]=>
+    string(4) "test"
+  }
+}

diff --git a/ext/opcache/zend_accelerator_util_funcs.c b/ext/opcache/zend_accelerator_util_funcs.c
index 0eb5b70cc57b75193a8606b070696973059b5ed8..53efa865c73c7c2f26e23b191b57b0a10615507a 100644 (file)
--- a/ext/opcache/zend_accelerator_util_funcs.c
+++ b/ext/opcache/zend_accelerator_util_funcs.c
@@ -246,7 +246,7 @@ static void zend_hash_clone_prop_info(HashTable *ht)
 
 #define zend_update_inherited_handler(handler) \
 { \
-       if (ce->handler != NULL) { \
+       if (ce->handler != NULL && IN_ARENA(ce->handler)) { \
                ce->handler = ARENA_REALLOC(ce->handler); \
        } \
 }