From: Dmitry Stogov <dmitry@php.net>
Date: Tue, 2 Feb 2010 12:32:29 +0000 (+0000)
Subject: Fixed bug #50723 (Bug in garbage collector causes crash)
X-Git-Tag: php-5.4.0alpha1~334
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=694a72c5afbac78bc13b3cfde7c1cfd2c1fc9f68;p=php

Fixed bug #50723 (Bug in garbage collector causes crash)
---

diff --git a/NEWS b/NEWS
index d7e7c3254d..f770d58e24 100644
--- a/NEWS
+++ b/NEWS
@@ -39,6 +39,7 @@ PHP                                                                        NEWS
 - Fixed bug #50732 (exec() adds single byte twice to $output array). (Ilia)
 - Fixed bug #50728 (All PDOExceptions hardcode 'code' property to 0).
   (Joey, Ilia)
+- Fixed bug #50723 (Bug in garbage collector causes crash). (Dmitry)
 - Fixed bug #50690 (putenv does not set ENV when the value is only one char).
   (Pierre)
 - Fixed bug #50680 (strtotime() does not support eighth ordinal number). (Ilia)
diff --git a/Zend/zend_execute.h b/Zend/zend_execute.h
index dcbe93aa10..be493cac19 100644
--- a/Zend/zend_execute.h
+++ b/Zend/zend_execute.h
@@ -228,7 +228,7 @@ static inline void *zend_vm_stack_alloc(size_t size TSRMLS_DC)
 		int extra = (ZEND_MM_ALIGNMENT - ((zend_uintptr_t)EG(argument_stack)->top & (ZEND_MM_ALIGNMENT - 1))) / sizeof(void*);
 
 		if (UNEXPECTED(size + extra + ZEND_MM_ALIGNED_SIZE(sizeof(void*)) / sizeof(void*) >
-		    (zend_uintptr_t)EG(argument_stack)->end - (zend_uintptr_t)EG(argument_stack)->top)) {
+		    (zend_uintptr_t)(EG(argument_stack)->end - EG(argument_stack)->top))) {
 			zend_vm_stack_extend(size TSRMLS_CC);
 		} else {
 			void **old_top = EG(argument_stack)->top;