From: Dmitry Stogov <dmitry@php.net>
Date: Mon, 6 Jun 2005 10:38:43 +0000 (+0000)
Subject: Fixed bug #32799 (crash: calling the corresponding global var during the destruct)
X-Git-Tag: php-5.0.1b1~75
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ce23692663fe377111d79bc03cba88c21626841c;p=php

Fixed bug #32799 (crash: calling the corresponding global var during the destruct)
---

diff --git a/Zend/tests/bug32799.phpt b/Zend/tests/bug32799.phpt
new file mode 100755
index 0000000000..7b09a50274
--- /dev/null
+++ b/Zend/tests/bug32799.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #32799 (crash: calling the corresponding global var during the destruct)
+--FILE--
+<?php
+class test{
+  public $c=1;
+  function __destruct (){
+    $GLOBALS['p']->c++; // no warning
+    print $GLOBALS['p']->c."\n"; // segfault
+  	var_dump($GLOBALS['p']);
+  }
+}
+$p=new test;
+$p=null; //destroy the object by a new assignment (segfault)
+?>
+--EXPECT--
+2
+object(test)#1 (1) {
+  ["c"]=>
+  int(2)
+}
diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c
index 6aa2d80b56..d37b4976e8 100644
--- a/Zend/zend_objects_API.c
+++ b/Zend/zend_objects_API.c
@@ -151,7 +151,9 @@ ZEND_API void zend_objects_store_del_ref(zval *zobject TSRMLS_DC)
 				EG(objects_store).object_buckets[handle].destructor_called = 1;
 
 				if (obj->dtor) {
+					zobject->refcount++;
 					obj->dtor(obj->object, handle TSRMLS_CC);
+					zobject->refcount--;
 				}
 			}
 			if (obj->refcount == 1) {