Fixed bug #32799 (crash: calling the corresponding global var during the destruct)

diff --git a/Zend/tests/bug32799.phpt b/Zend/tests/bug32799.phpt
new file mode 100755 (executable)
index 0000000..7b09a50
--- /dev/null
+++ b/Zend/tests/bug32799.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #32799 (crash: calling the corresponding global var during the destruct)
+--FILE--
+<?php
+class test{
+  public $c=1;
+  function __destruct (){
+    $GLOBALS['p']->c++; // no warning
+    print $GLOBALS['p']->c."\n"; // segfault
+       var_dump($GLOBALS['p']);
+  }
+}
+$p=new test;
+$p=null; //destroy the object by a new assignment (segfault)
+?>
+--EXPECT--
+2
+object(test)#1 (1) {
+  ["c"]=>
+  int(2)
+}

diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c
index 6aa2d80b5684a3c1e68b17e5b2d4f028edeb18e7..d37b4976e8281f690a3ddc55e8631ea2134d9692 100644 (file)
--- a/Zend/zend_objects_API.c
+++ b/Zend/zend_objects_API.c
@@ -151,7 +151,9 @@ ZEND_API void zend_objects_store_del_ref(zval *zobject TSRMLS_DC)
                                EG(objects_store).object_buckets[handle].destructor_called = 1;
 
                                if (obj->dtor) {
+                                       zobject->refcount++;
                                        obj->dtor(obj->object, handle TSRMLS_CC);
+                                       zobject->refcount--;
                                }
                        }
                        if (obj->refcount == 1) {