From: Xinchen Hui <laruence@php.net>
Date: Tue, 25 Jun 2013 05:47:50 +0000 (+0800)
Subject: Fixed bug #64827 Segfault in zval_mark_grey (zend_gc.c)
X-Git-Tag: php-5.5.2RC1~28
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=157ccaf507b7a94c43db4ec1b7321aac5cc68e8b;p=php

Fixed bug #64827 Segfault in zval_mark_grey (zend_gc.c)

I can not get a reproduce script since the context is very strict.

Of course I will try to make one, but for now, I just commit this first.
---

diff --git a/NEWS b/NEWS
index ee3d858e69..18eedd3f3e 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,7 @@ PHP                                                                        NEWS
     (David Soria Parra, Laruence)
 
 - OPcache
+  . Fixed bug #64827 (Segfault in zval_mark_grey (zend_gc.c)). (Laruence)
   . OPcache must be compatible with LiteSpeed SAPI (Dmitry)
 
 - CLI server:
diff --git a/ext/opcache/ZendAccelerator.c b/ext/opcache/ZendAccelerator.c
index 4d983976bb..efd902f431 100644
--- a/ext/opcache/ZendAccelerator.c
+++ b/ext/opcache/ZendAccelerator.c
@@ -2163,7 +2163,10 @@ static void accel_fast_zval_ptr_dtor(zval **zval_ptr)
 			case IS_CONSTANT_ARRAY: {
 					TSRMLS_FETCH();
 
+					GC_REMOVE_ZVAL_FROM_BUFFER(zvalue);
 					if (zvalue->value.ht && (zvalue->value.ht != &EG(symbol_table))) {
+						/* break possible cycles */
+						Z_TYPE_P(zvalue) = IS_NULL;
 						zvalue->value.ht->pDestructor = (dtor_func_t)accel_fast_zval_ptr_dtor;
 						accel_fast_hash_destroy(zvalue->value.ht);
 					}
@@ -2173,6 +2176,7 @@ static void accel_fast_zval_ptr_dtor(zval **zval_ptr)
 				{
 					TSRMLS_FETCH();
 
+					GC_REMOVE_ZVAL_FROM_BUFFER(zvalue);
 					Z_OBJ_HT_P(zvalue)->del_ref(zvalue TSRMLS_CC);
 				}
 				break;