Fixed bug #70970 (Segfault when combining error handler with output buffering)

of course we can try to refactor the current flow to make this error can
be catched safly.

but as 7.0.0 is releasing,  I don't think a refactor is safe now. and
actually I don't see any gain to make this catchable.

so let's keep this be consistent with 5.6 and safe for now

7 files changed, 36 insertions, 6 deletions

diff --git a/NEWS b/NEWS
index dc29b7d41b..dad3da214f 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? ??? 2015, PHP 7.0.1
 
 - Core:
+  . Fixed bug #70970 (Segfault when combining error handler with output
+    buffering). (Laruence)
   . Fixed bug #70958 (Invalid opcode while using ::class as trait method
     paramater default value). (Laruence)
   . Fixed bug #70947 (INI parser segfault with INI_SCANNER_TYPED). (Laruence)
diff --git a/main/output.c b/main/output.c
index 831c11f14a..41ae44a42e 100644
--- a/main/output.c
+++ b/main/output.c
@@ -763,7 +763,7 @@ static inline int php_output_lock_error(int op)
 	if (op && OG(active) && OG(running)) {
 		/* fatal error */
 		php_output_deactivate();
-		php_error_docref("ref.outcontrol", E_RECOVERABLE_ERROR, "Cannot use output buffering in output buffering display handlers");
+		php_error_docref("ref.outcontrol", E_ERROR, "Cannot use output buffering in output buffering display handlers");
 		return 1;
 	}
 	return 0;
diff --git a/tests/output/bug65593.phpt b/tests/output/bug65593.phpt
index 9ae62a1d72..3375a6bf08 100644
--- a/tests/output/bug65593.phpt
+++ b/tests/output/bug65593.phpt
@@ -6,8 +6,8 @@ echo "Test\n";
 
 ob_start(function(){ob_start();});
 ?>
-===DONE===
 --EXPECTF--
 Test
 
-Catchable fatal error: ob_start(): Cannot use output buffering in output buffering display handlers in %sbug65593.php on line %d
+Fatal error: ob_start(): Cannot use output buffering in output buffering display handlers in %sbug65593.php on line %d
+
diff --git a/tests/output/bug70970.phpt b/tests/output/bug70970.phpt
new file mode 100644
index 0000000000..87cc1b71c3
--- /dev/null
+++ b/tests/output/bug70970.phpt
@@ -0,0 +1,28 @@
+--TEST--
+Bug #70970 (Segfault when combining error handler with output buffering)
+--FILE--
+<?php
+function exception_error_handler($severity, $message, $file, $line)
+{
+	throw new Exception($message, 0, $severity, $file, $line);
+}
+
+set_error_handler('exception_error_handler');
+
+function obHandler($buffer, $phase = null)
+{
+	try {
+		ob_start();
+	} catch (Exception $e) {
+		return (string) $e;
+	}
+
+	return $buffer;
+}
+
+ob_start('obHandler');
+
+print 'test';
+?>
+--EXPECTF--
+Fatal error: ob_start(): Cannot use output buffering in output buffering display handlers in %sbug70970.php on line %d
diff --git a/tests/output/ob_010.phpt b/tests/output/ob_010.phpt
index 3e0c1a46e5..24d650c50d 100644
--- a/tests/output/ob_010.phpt
+++ b/tests/output/ob_010.phpt
@@ -10,4 +10,4 @@ ob_start("obh");
 echo "foo\n";
 ?>
 --EXPECTF--
-Catchable fatal error: print_r(): Cannot use output buffering in output buffering display handlers in %sob_010.php on line %d
+Fatal error: print_r(): Cannot use output buffering in output buffering display handlers in %sob_010.php on line %d
diff --git a/tests/output/ob_011.phpt b/tests/output/ob_011.phpt
index a411debe17..35b0388339 100644
--- a/tests/output/ob_011.phpt
+++ b/tests/output/ob_011.phpt
@@ -10,4 +10,4 @@ ob_start("obh");
 echo "foo\n";
 ?>
 --EXPECTF--
-Catchable fatal error: ob_get_flush(): Cannot use output buffering in output buffering display handlers in %sob_011.php on line %d
+Fatal error: ob_get_flush(): Cannot use output buffering in output buffering display handlers in %sob_011.php on line %d
diff --git a/tests/output/ob_start_error_005.phpt b/tests/output/ob_start_error_005.phpt
index ebe625504b..134f2249b7 100644
--- a/tests/output/ob_start_error_005.phpt
+++ b/tests/output/ob_start_error_005.phpt
@@ -20,4 +20,4 @@ var_dump(ob_start('f'));
 echo "done";
 ?>
 --EXPECTF--
-Catchable fatal error: ob_start(): Cannot use output buffering in output buffering display handlers in %s on line 9
+Fatal error: ob_start(): Cannot use output buffering in output buffering display handlers in %s on line 9