From: Xinchen Hui <laruence@gmail.com>
Date: Fri, 1 Apr 2016 14:27:29 +0000 (+0800)
Subject: Fixed bug #71930 (_zval_dtor_func: Assertion `(arr)->gc.refcount <= 1' failed)
X-Git-Tag: php-7.0.6RC1~45^2~1
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=5b1bb41c0b125fe9964abaa1d523ce2ba1823cf6;p=php

Fixed bug #71930 (_zval_dtor_func: Assertion `(arr)->gc.refcount <= 1' failed)
---

diff --git a/NEWS b/NEWS
index b81998b5d2..f86d7b2588 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? ??? 2016 PHP 7.0.6
 
 - Core:
+  . Fixed bug #71930 (_zval_dtor_func: Assertion `(arr)->gc.refcount <= 1'
+    failed). (Laruence)
   . Fixed bug #71914 (Reference is lost in "switch"). (Laruence)
   . Fixed Bug #71859 (zend_objects_store_call_destructors operates on realloced
     memory, crashing). (Laruence)
diff --git a/Zend/tests/bug71930.phpt b/Zend/tests/bug71930.phpt
new file mode 100644
index 0000000000..4604b88493
--- /dev/null
+++ b/Zend/tests/bug71930.phpt
@@ -0,0 +1,30 @@
+--TEST--
+Bug #71930 (_zval_dtor_func: Assertion `(arr)->gc.refcount <= 1' failed)
+--SKIPIF--
+<?php
+if (!extension_loaded("curl")) {
+  die("skip Require a resource which is able to hold a callbck");
+}
+?>
+--FILE--
+<?php
+
+class A {
+	public static function dummy() {
+	}
+}
+
+$a = array();
+$a[] = "A";
+$a[] = "dummy";
+
+$ch1 = curl_init();
+curl_setopt($ch1, CURLOPT_HEADERFUNCTION, $a);
+
+set_error_handler($a);
+set_error_handler(function()use($ch1){});
+set_error_handler(function(){});
+?>
+okey
+--EXPECT--
+okey
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 650f0a1e52..bdb9bb7bd5 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -295,8 +295,8 @@ void shutdown_executor(void) /* {{{ */
 		}
 
 		zend_stack_clean(&EG(user_error_handlers_error_reporting), NULL, 1);
-		zend_stack_clean(&EG(user_error_handlers), (void (*)(void *))ZVAL_DESTRUCTOR, 1);
-		zend_stack_clean(&EG(user_exception_handlers), (void (*)(void *))ZVAL_DESTRUCTOR, 1);
+		zend_stack_clean(&EG(user_error_handlers), (void (*)(void *))ZVAL_PTR_DTOR, 1);
+		zend_stack_clean(&EG(user_exception_handlers), (void (*)(void *))ZVAL_PTR_DTOR, 1);
 	} zend_end_try();
 
 	zend_try {