mirror of
https://github.com/php/php-src.git
synced 2024-09-21 18:07:23 +00:00
60a7e60b61
For objects with destructors, we will now only call the destructor in the initial GC run, and remove any nested data. The object is marked purple so it will be considered a root for the next GC run, at which point it will be fully destroyed, if possible. GC counts change on a number of tests, as the objects now get destroyed later.
32 lines
404 B
PHP
32 lines
404 B
PHP
--TEST--
|
|
Bug #72530: Use After Free in GC with Certain Destructors
|
|
--FILE--
|
|
<?php
|
|
|
|
class ryat {
|
|
var $ryat;
|
|
var $chtg;
|
|
|
|
function __destruct() {
|
|
$this->chtg = $this->ryat;
|
|
$this->ryat = 1;
|
|
}
|
|
}
|
|
|
|
$o = new ryat;
|
|
$o->ryat = $o;
|
|
$x =& $o->chtg;
|
|
|
|
unset($o);
|
|
gc_collect_cycles();
|
|
var_dump($x);
|
|
|
|
?>
|
|
--EXPECT--
|
|
object(ryat)#1 (2) {
|
|
["ryat"]=>
|
|
int(1)
|
|
["chtg"]=>
|
|
*RECURSION*
|
|
}
|