Fixed bug #39445 (Calling debug_backtrace() in the __toString() function produces...

diff --git a/Zend/tests/bug39445.phpt b/Zend/tests/bug39445.phpt
new file mode 100755 (executable)
index 0000000..cf1607f
--- /dev/null
+++ b/Zend/tests/bug39445.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #39445 (Calling debug_backtrace() in the __toString() function produces a crash)
+--FILE--
+<?php
+class test {
+       public function __toString() {
+               debug_backtrace();
+               return 'lowercase';
+       }
+}
+
+       $test = new test();
+       echo strtoupper($test);
+?>
+--EXPECT--
+LOWERCASE

diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
index 3c90193a050496f707a4a1a7b1adeac4f13ea5a7..fd59b12bc21be4298225350ffd27a18c11b07263 100644 (file)
--- a/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@ -1755,7 +1755,9 @@ static zval *debug_backtrace_get_args(void ***curpos TSRMLS_DC)
        while (--arg_count >= 0) {
                arg = (zval **) p++;
                if (*arg) {
-                       SEPARATE_ZVAL_TO_MAKE_IS_REF(arg);
+                       if ((*arg)->type != IS_OBJECT) {
+                               SEPARATE_ZVAL_TO_MAKE_IS_REF(arg);
+                       }
                        (*arg)->refcount++;
                        add_next_index_zval(arg_array, *arg);
                } else {