From: Dmitry Stogov <dmitry@zend.com>
Date: Tue, 31 Oct 2017 12:39:39 +0000 (+0300)
Subject: Workaroud for inconsistent ZVALs in AST produced by compiler (strings may be REFCOUNT... 
X-Git-Tag: php-7.3.0alpha1~1128
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=54ebab96408bd187f0d14237b8bf1885a66d1503;p=php

Workaroud for inconsistent ZVALs in AST produced by compiler (strings may be REFCOUNTED and INTERNED at the same time).
---

diff --git a/Zend/zend_ast.c b/Zend/zend_ast.c
index 26177c2c72..884caf2be2 100644
--- a/Zend/zend_ast.c
+++ b/Zend/zend_ast.c
@@ -565,6 +565,8 @@ ZEND_API zend_ast_ref *zend_ast_copy(zend_ast *ast)
 }
 
 ZEND_API void zend_ast_destroy(zend_ast *ast) {
+	zval *zv;
+
 	if (!ast) {
 		return;
 	}
@@ -574,7 +576,13 @@ ZEND_API void zend_ast_destroy(zend_ast *ast) {
 			/* Destroy value without using GC: When opcache moves arrays into SHM it will
 			 * free the zend_array structure, so references to it from outside the op array
 			 * become invalid. GC would cause such a reference in the root buffer. */
-			zval_ptr_dtor_nogc(zend_ast_get_zval(ast));
+			zv = zend_ast_get_zval(ast);
+			if (Z_TYPE_P(zv) == IS_STRING) {
+				/* Compiler may keep REFCOUNTED zvals with INTERNED strings */
+				zend_string_release(Z_STR_P(zv));
+			} else {
+				zval_ptr_dtor_nogc(zv);
+			}
 			break;
 		case ZEND_AST_CONSTANT:
 			zend_string_release(zend_ast_get_constant_name(ast));