From 4d8a9287163f89a22b07b65e9ca08d7cf38dac21 Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@php.net>
Date: Wed, 18 Feb 2009 12:03:03 +0000
Subject: [PATCH] Fixed bug #47343 (gc_collect_cycles causes a segfault when
 called within a destructor in one case)

---
 Zend/tests/bug47343.phpt | 44 ++++++++++++++++++++++++++++++++++++++++
 Zend/zend_gc.c           |  2 +-
 2 files changed, 45 insertions(+), 1 deletion(-)
 create mode 100644 Zend/tests/bug47343.phpt

diff --git a/Zend/tests/bug47343.phpt b/Zend/tests/bug47343.phpt
new file mode 100644
index 0000000000..07a3b4e330
--- /dev/null
+++ b/Zend/tests/bug47343.phpt
@@ -0,0 +1,44 @@
+--TEST--
+Bug #47343 (gc_collect_cycles causes a segfault when called within a destructor in one case)
+--FILE--
+<?php
+class A
+{
+	public function __destruct()
+	{
+		gc_collect_cycles();
+	}
+	
+	public function getB()
+	{
+		$this->data['foo'] = new B($this);
+		$this->data['bar'] = new B($this);
+		// Return either of the above
+		return $this->data['foo'];
+	}
+}
+
+class B
+{
+	public function B($A)
+	{
+		$this->A = $A;
+	}
+
+	public function __destruct()
+	{
+	}
+}
+
+for ($i = 0; $i < 2; $i++)
+{
+	$Aobj = new A;
+	$Bobj = $Aobj->getB();
+	unset($Bobj);
+	unset($Aobj);
+}
+
+echo "DONE\n";
+?>
+--EXPECT--
+DONE
diff --git a/Zend/zend_gc.c b/Zend/zend_gc.c
index 4f6616c920..95a4ac846c 100644
--- a/Zend/zend_gc.c
+++ b/Zend/zend_gc.c
@@ -521,7 +521,7 @@ static void gc_collect_roots(TSRMLS_D)
 	}
 }
 
-#define FREE_LIST_END ((zval_gc_info*)((-1)|~GC_COLOR))
+#define FREE_LIST_END ((zval_gc_info*)(~(zend_uintptr_t)GC_COLOR))
 
 ZEND_API int gc_collect_cycles(TSRMLS_D)
 {
-- 
2.50.1