clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-22 02:17:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Handle reallocated root buffer during GC destroy phase (v2)

Browse Source 
We no longer protect GC during the destroy phase, so we need to
deal with buffer reallocation.

Note that the implementation of spl_SplObjectStorage_free_storage
will call the destructor of SplObjectStorage, and free the instance properties,
which I think is what caused the root buffer to be reallocated.
(`current` is a pointer for an index within the root buffer?)

This fixes bug #78811 for me.

Closes GH-4935
This commit is contained in:
Tyson Andre 2019-11-19 19:12:56 -05:00
parent e7e15450ef
commit 500ba8b2b8
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Zend/zend_gc.c
View File

@ -1551,6 +1551,8 @@ ZEND_API int zend_gc_collect_cycles(void)
EG(objects_store).object_buckets[obj->handle] = SET_OBJ_INVALID(obj);
GC_TYPE_INFO(obj) = IS_NULL |
(GC_TYPE_INFO(obj) & ~GC_TYPE_MASK);
/* Modify current before calling free_obj (bug #78811: free_obj() can cause the root buffer (with current) to be reallocated.) */
current->ref = GC_MAKE_GARBAGE(((char*)obj) - obj->handlers->offset);
if (!(OBJ_FLAGS(obj) & IS_OBJ_FREE_CALLED)) {
GC_ADD_FLAGS(obj, IS_OBJ_FREE_CALLED);
GC_ADDREF(obj);
@ -1559,7 +1561,6 @@ ZEND_API int zend_gc_collect_cycles(void)
}
ZEND_OBJECTS_STORE_ADD_TO_FREE_LIST(obj->handle);
current->ref = GC_MAKE_GARBAGE(((char*)obj) - obj->handlers->offset);
} else if (GC_TYPE(p) == IS_ARRAY) {
zend_array *arr = (zend_array*)p;