Merge branch 'PHP-5.5' of git.php.net:php-src into PHP-5.5

* 'PHP-5.5' of git.php.net:php-src:
  Fixed bug #68370 ("unset($this)" can make the program crash)
  Fixed NEWS for 5.5
  Fix opcache.revalidate_freq per-request behavior
  Partial fix for bug #68365 (zend_mm_heap corrupted after memory overflow in zend_hash_copy)

6 files changed, 23 insertions, 30 deletions

diff --git a/NEWS b/NEWS
index 2340bea13d..79a2b8893f 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,7 @@ PHP                                                                        NEWS
 ?? ??? 2014, PHP 5.5.19
 
 - Core:
+  . Fixed bug #68370 ("unset($this)" can make the program crash). (Laruence)
   . Fixed bug #68095 (AddressSanitizer reports a heap buffer overflow in 
     php_getopt()). (Stas)
   . Fixed bug #68118 ($a->foo .= 'test'; can leave $a->foo undefined). (Nikita)
@@ -32,13 +33,6 @@ PHP                                                                        NEWS
   . Fixed bug #68087 (ODBC not correctly reading DATE column when preceded by
     a VARCHAR column) (Keyur Govande)
 
-- PDO_pgsql:
-  . Fixed bug #66584 (Segmentation fault on statement deallocation) (Matteo)
-  . Fixed bug #67462 (PDO_PGSQL::beginTransaction() wrongly throws exception
-    when not in transaction) (Matteo)
-  . Fixed bug #68351 (PDO::PARAM_BOOL and ATTR_EMULATE_PREPARES misbehaving)
-    (Matteo)
-
 - SPL:
   . Fixed bug #68128 (Regression in RecursiveRegexIterator) (Tjerk)
 
diff --git a/Zend/tests/bug68370.phpt b/Zend/tests/bug68370.phpt
new file mode 100644
index 0000000000..25589bf455
--- /dev/null
+++ b/Zend/tests/bug68370.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #68370 "unset($this)" can make the program crash
+--FILE--
+<?php
+class C {
+	public function test() {
+		unset($this);
+		return get_defined_vars();
+	}
+}
+$c = new C();
+$x = $c->test();
+print_r($x);
+unset($c, $x);
+--EXPECTF--
+Array
+(
+)
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 7e2a3378da..9d4eebf010 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -1761,13 +1761,6 @@ ZEND_API void zend_rebuild_symbol_table(TSRMLS_D) /* {{{ */
 				/*printf("Cache miss!  Initialized %x\n", EG(active_symbol_table));*/
 			}
 			ex->symbol_table = EG(active_symbol_table);
-
-			if (ex->op_array->this_var != -1 &&
-			    !*EX_CV_NUM(ex, ex->op_array->this_var) &&
-			    EG(This)) {
-			    *EX_CV_NUM(ex, ex->op_array->this_var) = (zval**)EX_CV_NUM(ex, ex->op_array->last_var + ex->op_array->this_var);
-				**EX_CV_NUM(ex, ex->op_array->this_var) = EG(This);
- 			}
 			for (i = 0; i < ex->op_array->last_var; i++) {
 				if (*EX_CV_NUM(ex, i)) {
 					zend_hash_quick_update(EG(active_symbol_table),
diff --git a/Zend/zend_variables.c b/Zend/zend_variables.c
index 9674de5246..cc73c379a7 100644
--- a/Zend/zend_variables.c
+++ b/Zend/zend_variables.c
@@ -135,9 +135,9 @@ ZEND_API void _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC)
 				}
 				ALLOC_HASHTABLE_REL(tmp_ht);
 				zend_hash_init(tmp_ht, zend_hash_num_elements(original_ht), NULL, ZVAL_PTR_DTOR, 0);
+				zvalue->value.ht = tmp_ht;
 				zend_hash_copy(tmp_ht, original_ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
 				tmp_ht->nNextFreeElement = original_ht->nNextFreeElement;
-				zvalue->value.ht = tmp_ht;
 			}
 			break;
 		case IS_OBJECT:
diff --git a/ext/opcache/ZendAccelerator.c b/ext/opcache/ZendAccelerator.c
index 44064004f8..1d3bd959ff 100644
--- a/ext/opcache/ZendAccelerator.c
+++ b/ext/opcache/ZendAccelerator.c
@@ -881,12 +881,12 @@ static inline int do_validate_timestamps(zend_persistent_script *persistent_scri
 int validate_timestamp_and_record(zend_persistent_script *persistent_script, zend_file_handle *file_handle TSRMLS_DC)
 {
 	if (ZCG(accel_directives).revalidate_freq &&
-	    (persistent_script->dynamic_members.revalidate >= ZCSG(revalidate_at))) {
+	    persistent_script->dynamic_members.revalidate >= ZCG(request_time)) {
 		return SUCCESS;
 	} else if (do_validate_timestamps(persistent_script, file_handle TSRMLS_CC) == FAILURE) {
 		return FAILURE;
 	} else {
-		persistent_script->dynamic_members.revalidate = ZCSG(revalidate_at);
+		persistent_script->dynamic_members.revalidate = ZCG(request_time) + ZCG(accel_directives).revalidate_freq;
 		return SUCCESS;
 	}
 }
@@ -1449,7 +1449,7 @@ static zend_persistent_script *compile_and_cache_file(zend_file_handle *file_han
 		 * otherwise we have a race-condition.
 		 */
 		new_persistent_script->timestamp = timestamp;
-		new_persistent_script->dynamic_members.revalidate = ZCSG(revalidate_at);
+		new_persistent_script->dynamic_members.revalidate = ZCG(request_time) + ZCG(accel_directives).revalidate_freq;
 	}
 
 	if (file_handle->opened_path) {
@@ -2155,13 +2155,6 @@ static void accel_activate(void)
 		zend_accel_error(ACCEL_LOG_WARNING, "Internal functions count changed - was %d, now %d", ZCG(internal_functions_count), zend_hash_num_elements(&ZCG(function_table)));
 	}
 
-	if (ZCG(accel_directives).validate_timestamps) {
-		time_t now = ZCG(request_time);
-		if (now > ZCSG(revalidate_at) + (time_t)ZCG(accel_directives).revalidate_freq) {
-			ZCSG(revalidate_at) = now;
-		}
-	}
-
 	ZCG(cwd) = NULL;
 
 	SHM_PROTECT();
@@ -2622,10 +2615,6 @@ static int accel_startup(zend_extension *extension)
 	zend_resolve_path = persistent_zend_resolve_path;
 #endif
 
-	if (ZCG(accel_directives).validate_timestamps) {
-		ZCSG(revalidate_at) = zend_accel_get_time() + ZCG(accel_directives).revalidate_freq;
-	}
-
 	/* Override chdir() function */
 	if (zend_hash_find(CG(function_table), "chdir", sizeof("chdir"), (void**)&func) == SUCCESS &&
 	    func->type == ZEND_INTERNAL_FUNCTION) {
diff --git a/ext/opcache/ZendAccelerator.h b/ext/opcache/ZendAccelerator.h
index bba36316d9..547e315823 100644
--- a/ext/opcache/ZendAccelerator.h
+++ b/ext/opcache/ZendAccelerator.h
@@ -297,7 +297,6 @@ typedef struct _zend_accel_shared_globals {
     unsigned long   restart_in;
 #endif
 	zend_bool       restart_in_progress;
-    time_t          revalidate_at;
 #if ZEND_EXTENSION_API_NO > PHP_5_3_X_API_NO
 	/* Interned Strings Support */
 	char           *interned_strings_start;