From d5c171311d3a19999bf02cb56b4b082ec5eaaef1 Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@gmail.com>
Date: Wed, 28 Feb 2018 18:06:37 +0800
Subject: [PATCH] Fixed bug #76025 (Segfault while throwing exception in
 error_handler).

---
 NEWS                     |  6 ++++++
 Zend/tests/bug76025.phpt | 18 ++++++++++++++++++
 Zend/zend_execute.c      |  7 ++++---
 3 files changed, 28 insertions(+), 3 deletions(-)
 create mode 100644 Zend/tests/bug76025.phpt

diff --git a/NEWS b/NEWS
index b5c15891fc..14a5b29f6a 100644
--- a/NEWS
+++ b/NEWS
@@ -1,5 +1,11 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+?? ??? ????, PHP 7.1.16
+
+- Core:
+  . Fixed bug #76025 (Segfault while throwing exception in error_handler).
+    (Dmitry, Laruence)
+
 01 Feb 2018, PHP 7.1.15
 
 - Apache2Handler:
diff --git a/Zend/tests/bug76025.phpt b/Zend/tests/bug76025.phpt
new file mode 100644
index 0000000000..2619984d1e
--- /dev/null
+++ b/Zend/tests/bug76025.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #76025 (Segfault while throwing exception in error_handler)
+--FILE--
+<?php
+
+function handleError($errno, $errstr, $errfile, $errline) {
+	$exception = new exception("blah");
+	throw $exception;
+}
+set_error_handler('handleError', E_ALL);
+$c = $b[$a];
+?>
+--EXPECTF--
+Fatal error: Uncaught Exception: blah in %sbug76025.php:%d
+Stack trace:
+#0 %sbug76025.php(%d): handleError(8, 'Undefined varia...', '%s', %d, Array)
+#1 {main}
+  thrown in %sbug76025.php on line %d
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index a420a82917..968618a6aa 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -213,9 +213,10 @@ static zend_always_inline zval *_get_zval_ptr_var_deref(uint32_t var, const zend
 
 static zend_never_inline ZEND_COLD void zval_undefined_cv(uint32_t var, const zend_execute_data *execute_data)
 {
-	zend_string *cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
-
-	zend_error(E_NOTICE, "Undefined variable: %s", ZSTR_VAL(cv));
+	if (EXPECTED(EG(exception) == NULL)) {
+		zend_string *cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
+		zend_error(E_NOTICE, "Undefined variable: %s", ZSTR_VAL(cv));
+	}
 }
 
 static zend_never_inline zval *_get_zval_cv_lookup(zval *ptr, uint32_t var, int type, const zend_execute_data *execute_data)
-- 
2.50.1