Fixed bug #70215 (segfault when __invoke is static)

diff --git a/NEWS b/NEWS
index 22371a511db9406bf9961d05b8f68b175f000cf5..4862c9ecf6e1116cde565ab78b4b973350812127 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,12 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 20 Aug 2015, PHP 7.0.0 RC 1
 
+- Code:
+  . Fixed bug #70215 (Segfault when __invoke is static). (Bob)
+
+- Phpdbg:
+  . Fixed bug #70214 (FASYNC not defined, needs sys/file.h include). (Bob)
+
 - Standard:
   . Fixed bug #70208 (Assert breaking access on objects). (Bob)
 

diff --git a/Zend/tests/bug70215.phpt b/Zend/tests/bug70215.phpt
new file mode 100644 (file)
index 0000000..527920c
--- /dev/null
+++ b/Zend/tests/bug70215.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #70215 (Segfault when invoke is static)
+--FILE--
+<?php
+
+class A {
+       public static function __invoke() {
+               echo __CLASS__;
+       }
+}
+
+class B extends A { }
+
+$b = new B;
+
+$b();
+
+?>
+--EXPECTF--
+Warning: The magic method __invoke() must have public visibility and cannot be static in %s on line %d
+A

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index b3ae031dee2b89fb35d8a62aa070cd188586a9ce..6339ec631c25e5c6adbe291cd584178cc8eb0f90 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3249,7 +3249,7 @@ ZEND_VM_C_LABEL(try_function_name):
                        ZEND_ASSERT(GC_TYPE(fbc->common.prototype) == IS_OBJECT);
                        GC_REFCOUNT(fbc->common.prototype)++;
                        call_info |= ZEND_CALL_CLOSURE;
-               } else {
+               } else if (object) {
                        call_info |= ZEND_CALL_RELEASE_THIS;
                        GC_REFCOUNT(object)++; /* For $this pointer */
                }

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index f1927ff7f66f4e3ae1942b0f8363996d41e474f4..a0a1c1f0d01cd5c5a8c0f8e10ce0a68917cb9b6e 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -2019,7 +2019,7 @@ try_function_name:
                        ZEND_ASSERT(GC_TYPE(fbc->common.prototype) == IS_OBJECT);
                        GC_REFCOUNT(fbc->common.prototype)++;
                        call_info |= ZEND_CALL_CLOSURE;
-               } else {
+               } else if (object) {
                        call_info |= ZEND_CALL_RELEASE_THIS;
                        GC_REFCOUNT(object)++; /* For $this pointer */
                }
@@ -2441,7 +2441,7 @@ try_function_name:
                        ZEND_ASSERT(GC_TYPE(fbc->common.prototype) == IS_OBJECT);
                        GC_REFCOUNT(fbc->common.prototype)++;
                        call_info |= ZEND_CALL_CLOSURE;
-               } else {
+               } else if (object) {
                        call_info |= ZEND_CALL_RELEASE_THIS;
                        GC_REFCOUNT(object)++; /* For $this pointer */
                }
@@ -2696,7 +2696,7 @@ try_function_name:
                        ZEND_ASSERT(GC_TYPE(fbc->common.prototype) == IS_OBJECT);
                        GC_REFCOUNT(fbc->common.prototype)++;
                        call_info |= ZEND_CALL_CLOSURE;
-               } else {
+               } else if (object) {
                        call_info |= ZEND_CALL_RELEASE_THIS;
                        GC_REFCOUNT(object)++; /* For $this pointer */
                }