Fixed bug #45805 (Crach on throwing exception from error handler)

diff --git a/Zend/tests/bug45805.phpt b/Zend/tests/bug45805.phpt
new file mode 100755 (executable)
index 0000000..ae8424c
--- /dev/null
+++ b/Zend/tests/bug45805.phpt
@@ -0,0 +1,46 @@
+--TEST--
+Bug #45805 (Crach on throwing exception from error handler)
+--FILE--
+<?php
+class PHPUnit_Util_ErrorHandler
+{
+    public static function handleError($errno, $errstr, $errfile, $errline)
+    {
+        throw new RuntimeException;
+    }
+}
+
+class A {
+    public function getX() {
+        return NULL;
+    }
+}
+
+class B {
+    public function foo() {
+        $obj    = new A;
+        $source = &$obj->getX();
+    }
+
+    public function bar() {
+        $m = new ReflectionMethod('B', 'foo');
+        $m->invoke($this);
+    }
+}
+
+set_error_handler(
+  array('PHPUnit_Util_ErrorHandler', 'handleError'), E_ALL | E_STRICT
+);
+            
+$o = new B;
+$o->bar();
+?>
+--EXPECTF--
+Fatal error: Uncaught exception 'RuntimeException' in %sbug45805.php:%d
+Stack trace:
+#0 %sbug45805.php(%d): PHPUnit_Util_ErrorHandler::handleError(2048, 'Only variables ...', '%s', %d, Array)
+#1 [internal function]: B->foo()
+#2 %sbug45805.php(%d): ReflectionMethod->invoke(Object(B))
+#3 %sbug45805.php(%d): B->bar()
+#4 {main}
+  thrown in %sbug45805.php on line %d

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 0f3372717c7627ea5b3fafc2b4183cb5d2d7c9b0..cef9d961ab7c51d6a70af914a3cda69d8352604f 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1664,6 +1664,10 @@ ZEND_VM_HANDLER(39, ZEND_ASSIGN_REF, VAR|CV, VAR|CV)
                        PZVAL_LOCK(*value_ptr_ptr); /* undo the effect of get_zval_ptr_ptr() */
                }
                zend_error(E_STRICT, "Only variables should be assigned by reference");
+               if (UNEXPECTED(EG(exception) != NULL)) {
+                       FREE_OP2_VAR_PTR();
+                       ZEND_VM_NEXT_OPCODE();
+               }
                ZEND_VM_DISPATCH_TO_HANDLER(ZEND_ASSIGN);
        } else if (OP2_TYPE == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
                PZVAL_LOCK(*value_ptr_ptr);

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index d6fad02ef36e0b86f3c8491ba58c65167d811b5d..e8649a43c92b2adcf92b00a0210e8acf5e77ae5a 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -14442,6 +14442,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDL
                        PZVAL_LOCK(*value_ptr_ptr); /* undo the effect of get_zval_ptr_ptr() */
                }
                zend_error(E_STRICT, "Only variables should be assigned by reference");
+               if (UNEXPECTED(EG(exception) != NULL)) {
+                       if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
+                       ZEND_VM_NEXT_OPCODE();
+               }
                return ZEND_ASSIGN_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
        } else if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
                PZVAL_LOCK(*value_ptr_ptr);
@@ -16952,6 +16956,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLE
                        PZVAL_LOCK(*value_ptr_ptr); /* undo the effect of get_zval_ptr_ptr() */
                }
                zend_error(E_STRICT, "Only variables should be assigned by reference");
+               if (UNEXPECTED(EG(exception) != NULL)) {
+
+                       ZEND_VM_NEXT_OPCODE();
+               }
                return ZEND_ASSIGN_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
        } else if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
                PZVAL_LOCK(*value_ptr_ptr);
@@ -28641,6 +28649,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLE
                        PZVAL_LOCK(*value_ptr_ptr); /* undo the effect of get_zval_ptr_ptr() */
                }
                zend_error(E_STRICT, "Only variables should be assigned by reference");
+               if (UNEXPECTED(EG(exception) != NULL)) {
+                       if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
+                       ZEND_VM_NEXT_OPCODE();
+               }
                return ZEND_ASSIGN_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
        } else if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
                PZVAL_LOCK(*value_ptr_ptr);
@@ -30916,6 +30928,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER
                        PZVAL_LOCK(*value_ptr_ptr); /* undo the effect of get_zval_ptr_ptr() */
                }
                zend_error(E_STRICT, "Only variables should be assigned by reference");
+               if (UNEXPECTED(EG(exception) != NULL)) {
+
+                       ZEND_VM_NEXT_OPCODE();
+               }
                return ZEND_ASSIGN_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
        } else if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
                PZVAL_LOCK(*value_ptr_ptr);