Fixed bug #34729 (Crash in ZTS mode under Apache)

11 files changed, 74 insertions, 23 deletions

diff --git a/NEWS b/NEWS
index d6a3952920..7629acc674 100644
--- a/NEWS
+++ b/NEWS
@@ -19,6 +19,7 @@ PHP                                                                        NEWS
   connecting to 5.x server. (Andrey)
 - Fixed bug #35496 (Crash in mcrypt_generic()/mdecrypt_generic() without 
   proper init). (Ilia)
+- Fixed bug #34729 (Crash in ZTS mode under Apache). (Dmitry, Zeev) 
 - Fixed bug #35470 (Assigning global using variable name from array doesn't
   function). (Dmitry)
 - Fixed bug #35456 (+ 1 [time unit] format did not work). (Ilia)
diff --git a/Zend/zend.c b/Zend/zend.c
index b0150da993..f2663e8d5d 100644
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -453,6 +453,13 @@ static void compiler_globals_ctor(zend_compiler_globals *compiler_globals TSRMLS
 	compiler_globals->auto_globals = (HashTable *) malloc(sizeof(HashTable));
 	zend_hash_init_ex(compiler_globals->auto_globals, 8, NULL, NULL, 1, 0);
 	zend_hash_copy(compiler_globals->auto_globals, global_auto_globals_table, NULL, NULL, sizeof(zend_auto_global) /* empty element */);
+
+	compiler_globals->last_static_member = zend_hash_num_elements(compiler_globals->class_table);
+	if (compiler_globals->last_static_member) {
+		compiler_globals->static_members = (HashTable**)calloc(compiler_globals->last_static_member, sizeof(HashTable*));
+	} else {
+		compiler_globals->static_members = NULL;
+	}
 }
 
 
@@ -470,6 +477,10 @@ static void compiler_globals_dtor(zend_compiler_globals *compiler_globals TSRMLS
 		zend_hash_destroy(compiler_globals->auto_globals);
 		free(compiler_globals->auto_globals);
 	}
+	if (compiler_globals->static_members) {
+		free(compiler_globals->static_members);
+	}
+	compiler_globals->last_static_member = 0;
 }
 
 
diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index d531371ded..bae16c5492 100644
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -755,22 +755,26 @@ ZEND_API void zend_merge_properties(zval *obj, HashTable *properties, int destro
 
 ZEND_API void zend_update_class_constants(zend_class_entry *class_type TSRMLS_DC)
 {
-	if (!class_type->constants_updated || !class_type->static_members) {
+	if (!class_type->constants_updated || !CE_STATIC_MEMBERS(class_type)) {
 		zend_class_entry **scope = EG(in_execution)?&EG(scope):&CG(active_class_entry);
 		zend_class_entry *old_scope = *scope;
 
 		*scope = class_type;
 		zend_hash_apply_with_argument(&class_type->default_properties, (apply_func_arg_t) zval_update_constant, (void *) 1 TSRMLS_CC);
 
-		if (!class_type->static_members) {
+		if (!CE_STATIC_MEMBERS(class_type)) {
 			HashPosition pos;
 			zval **p;
 
 			if (class_type->parent) {
 				zend_update_class_constants(class_type->parent TSRMLS_CC);
 			}
+#if ZTS
+			ALLOC_HASHTABLE(CG(static_members)[(long)(class_type->static_members)]);
+#else
 			ALLOC_HASHTABLE(class_type->static_members);
-			zend_hash_init(class_type->static_members, 0, NULL, ZVAL_PTR_DTOR, 0);
+#endif
+			zend_hash_init(CE_STATIC_MEMBERS(class_type), 0, NULL, ZVAL_PTR_DTOR, 0);
 
 			zend_hash_internal_pointer_reset_ex(&class_type->default_static_members, &pos);
 			while (zend_hash_get_current_data_ex(&class_type->default_static_members, (void**)&p, &pos) == SUCCESS) {
@@ -784,10 +788,10 @@ ZEND_API void zend_update_class_constants(zend_class_entry *class_type TSRMLS_DC
 				    class_type->parent &&
 				    zend_hash_find(&class_type->parent->default_static_members, str_index, str_length, (void**)&q) == SUCCESS &&
 				    *p == *q &&
-				    zend_hash_find(class_type->parent->static_members, str_index, str_length, (void**)&q) == SUCCESS) {
+				    zend_hash_find(CE_STATIC_MEMBERS(class_type->parent), str_index, str_length, (void**)&q) == SUCCESS) {
 					(*q)->refcount++;
 					(*q)->is_ref = 1;
-					zend_hash_add(class_type->static_members, str_index, str_length, (void**)q, sizeof(zval*), NULL);
+					zend_hash_add(CE_STATIC_MEMBERS(class_type), str_index, str_length, (void**)q, sizeof(zval*), NULL);
 				} else {
 					zval *q;
 					
@@ -795,12 +799,12 @@ ZEND_API void zend_update_class_constants(zend_class_entry *class_type TSRMLS_DC
 					*q = **p;
 					INIT_PZVAL(q);
 					zval_copy_ctor(q);
-					zend_hash_add(class_type->static_members, str_index, str_length, (void**)&q, sizeof(zval*), NULL);
+					zend_hash_add(CE_STATIC_MEMBERS(class_type), str_index, str_length, (void**)&q, sizeof(zval*), NULL);
 				}
 				zend_hash_move_forward_ex(&class_type->default_static_members, &pos);
 			}
 		}
-		zend_hash_apply_with_argument(class_type->static_members, (apply_func_arg_t) zval_update_constant, (void *) 1 TSRMLS_CC);
+		zend_hash_apply_with_argument(CE_STATIC_MEMBERS(class_type), (apply_func_arg_t) zval_update_constant, (void *) 1 TSRMLS_CC);
 
 		*scope = old_scope;
 		class_type->constants_updated = 1;
diff --git a/Zend/zend_API.h b/Zend/zend_API.h
index ef4156430e..d30d7f7499 100644
--- a/Zend/zend_API.h
+++ b/Zend/zend_API.h
@@ -146,6 +146,12 @@ typedef struct _zend_function_entry {
 #define INIT_OVERLOADED_CLASS_ENTRY(class_container, class_name, functions, handle_fcall, handle_propget, handle_propset) \
 	INIT_OVERLOADED_CLASS_ENTRY_EX(class_container, class_name, functions, handle_fcall, handle_propget, handle_propset, NULL, NULL)
 
+#ifdef ZTS
+#	define CE_STATIC_MEMBERS(ce) (((ce)->type==ZEND_USER_CLASS)?(ce)->static_members:CG(static_members)[(long)(ce)->static_members])
+#else
+#	define CE_STATIC_MEMBERS(ce) ((ce)->static_members)
+#endif
+
 int zend_next_free_module(void);
 
 BEGIN_EXTERN_C()
diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
index 61caabc5ed..5c9917443e 100644
--- a/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@ -738,7 +738,7 @@ ZEND_FUNCTION(get_class_vars)
 		array_init(return_value);
 		add_class_vars(*pce, &(*pce)->default_properties, return_value TSRMLS_CC);
 		zend_update_class_constants(*pce TSRMLS_CC);
-		add_class_vars(*pce, (*pce)->static_members, return_value TSRMLS_CC);
+		add_class_vars(*pce, CE_STATIC_MEMBERS(*pce), return_value TSRMLS_CC);
 	}
 }
 /* }}} */
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index c40b4845e6..f9257698fd 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -2090,7 +2090,9 @@ static zend_bool do_inherit_property_access_check(HashTable *target_ht, zend_pro
 
 				if (parent_ce->type != ce->type) {
 					/* User class extends internal class */
-					ht = parent_ce->static_members;
+					TSRMLS_FETCH();
+
+					ht = CE_STATIC_MEMBERS(parent_ce);
 				} else {
 					ht = &parent_ce->default_static_members;
 				}
@@ -2196,7 +2198,7 @@ ZEND_API void zend_do_inheritance(zend_class_entry *ce, zend_class_entry *parent
 	if (parent_ce->type != ce->type) {
 		/* User class extends internal class */
 		zend_update_class_constants(parent_ce  TSRMLS_CC);
-		zend_hash_merge(&ce->default_static_members, parent_ce->static_members, (void (*)(void *)) inherit_static_prop, NULL, sizeof(zval *), 0);
+		zend_hash_merge(&ce->default_static_members, CE_STATIC_MEMBERS(parent_ce), (void (*)(void *)) inherit_static_prop, NULL, sizeof(zval *), 0);
 	} else {
 		zend_hash_merge(&ce->default_static_members, &parent_ce->default_static_members, (void (*)(void *)) inherit_static_prop, NULL, sizeof(zval *), 0);
 	}
@@ -4026,7 +4028,23 @@ ZEND_API void zend_initialize_class_data(zend_class_entry *ce, zend_bool nullify
 	zend_hash_init_ex(&ce->constants_table, 0, NULL, zval_ptr_dtor_func, persistent_hashes, 0);
 	zend_hash_init_ex(&ce->function_table, 0, NULL, ZEND_FUNCTION_DTOR, persistent_hashes, 0);
 
-	ce->static_members = (ce->type == ZEND_INTERNAL_CLASS) ? NULL : &ce->default_static_members;
+	if (ce->type == ZEND_INTERNAL_CLASS) {
+#ifdef ZTS
+		int n = zend_hash_num_elements(CG(class_table));
+
+		if (CG(static_members) && n >= CG(last_static_member)) {
+			/* Support for run-time declaration: dl() */
+			CG(last_static_member) = n+1;
+			CG(static_members) = realloc(CG(static_members), (n+1)*sizeof(HashTable*));
+			CG(static_members)[n] = NULL;
+		}
+		ce->static_members = (HashTable*)n;
+#else
+		ce->static_members = NULL;
+#endif
+	} else {
+		ce->static_members = &ce->default_static_members;
+	}
 
 	if (nullify_handlers) {
 		ce->constructor = NULL;
diff --git a/Zend/zend_globals.h b/Zend/zend_globals.h
index 198b3640c6..80399e59b5 100644
--- a/Zend/zend_globals.h
+++ b/Zend/zend_globals.h
@@ -144,6 +144,11 @@ struct _zend_compiler_globals {
 	zend_encoding_converter encoding_converter;
 	zend_encoding_oddlen encoding_oddlen;
 #endif /* ZEND_MULTIBYTE */
+
+#ifdef ZTS
+	HashTable **static_members;
+	int last_static_member;
+#endif
 };
 
 
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index a4b80db38b..4bdcd858b4 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -857,7 +857,7 @@ ZEND_API zval **zend_std_get_static_property(zend_class_entry *ce, char *propert
 
 	zend_update_class_constants(tmp_ce TSRMLS_CC);
 
-	zend_hash_quick_find(tmp_ce->static_members, property_info->name, property_info->name_length+1, property_info->h, (void **) &retval);
+	zend_hash_quick_find(CE_STATIC_MEMBERS(tmp_ce), property_info->name, property_info->name_length+1, property_info->h, (void **) &retval);
 
 	if (!retval) {
 		if (silent) {
diff --git a/Zend/zend_opcode.c b/Zend/zend_opcode.c
index 9b305b25e2..a4bf456c12 100644
--- a/Zend/zend_opcode.c
+++ b/Zend/zend_opcode.c
@@ -138,18 +138,20 @@ ZEND_API int zend_cleanup_function_data(zend_function *function TSRMLS_DC)
 
 ZEND_API int zend_cleanup_class_data(zend_class_entry **pce TSRMLS_DC)
 {
-	if ((*pce)->static_members) {
-		if ((*pce)->static_members != &(*pce)->default_static_members) {
-			zend_hash_destroy((*pce)->static_members);
-			FREE_HASHTABLE((*pce)->static_members);
-		}
-		(*pce)->static_members = NULL;
-	}
 	if ((*pce)->type == ZEND_USER_CLASS) {
 		/* Clean all parts that can contain run-time data */
 		/* Note that only run-time accessed data need to be cleaned up, pre-defined data can
 		   not contain objects and thus are not probelmatic */
 		zend_hash_apply(&(*pce)->function_table, (apply_func_t) zend_cleanup_function_data TSRMLS_CC);
+		(*pce)->static_members = NULL;
+	} else if (CE_STATIC_MEMBERS(*pce)) {
+		zend_hash_destroy(CE_STATIC_MEMBERS(*pce));
+		FREE_HASHTABLE(CE_STATIC_MEMBERS(*pce));
+#ifdef ZTS
+		CG(static_members)[(long)((*pce)->static_members)] = NULL;
+#else
+		(*pce)->static_members = NULL;
+#endif
 	}
 	return 0;
 }
diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index a456f38768..5258c4850e 100644
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -2529,7 +2529,7 @@ ZEND_METHOD(reflection_class, getStaticProperties)
 	zend_update_class_constants(ce TSRMLS_CC);
 
 	array_init(return_value);
-	zend_hash_copy(Z_ARRVAL_P(return_value), ce->static_members, (copy_ctor_func_t) zval_add_ref, (void *) &tmp_copy, sizeof(zval *));
+	zend_hash_copy(Z_ARRVAL_P(return_value), CE_STATIC_MEMBERS(ce), (copy_ctor_func_t) zval_add_ref, (void *) &tmp_copy, sizeof(zval *));
 }
 /* }}} */
 
@@ -3633,7 +3633,7 @@ ZEND_METHOD(reflection_property, getValue)
 
 	if ((ref->prop->flags & ZEND_ACC_STATIC)) {
 		zend_update_class_constants(intern->ce TSRMLS_CC);
-		if (zend_hash_quick_find(intern->ce->static_members, ref->prop->name, ref->prop->name_length + 1, ref->prop->h, (void **) &member) == FAILURE) {
+		if (zend_hash_quick_find(CE_STATIC_MEMBERS(intern->ce), ref->prop->name, ref->prop->name_length + 1, ref->prop->h, (void **) &member) == FAILURE) {
 			zend_error(E_ERROR, "Internal error: Could not find the property %s", ref->prop->name);
 			/* Bails out */
 		}
@@ -3681,7 +3681,7 @@ ZEND_METHOD(reflection_property, setValue)
 			}
 		}
 		zend_update_class_constants(intern->ce TSRMLS_CC);
-		prop_table = intern->ce->static_members;
+		prop_table = CE_STATIC_MEMBERS(intern->ce);
 	} else {
 		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "oz", &object, &value) == FAILURE) {
 			return;
diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index a4e1ced714..be910cf789 100644
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -107,6 +107,8 @@ php_basic_globals basic_globals;
 #include "php_fopen_wrappers.h"
 #include "streamsfuncs.h"
 
+static zend_class_entry *incomplete_class_entry = NULL;
+
 static
 	ZEND_BEGIN_ARG_INFO(first_and_second__args_force_ref, 0)
 		ZEND_ARG_PASS_INFO(1)
@@ -956,7 +958,7 @@ static void basic_globals_ctor(php_basic_globals *basic_globals_p TSRMLS_DC)
 	memset(&BG(mblen_state), 0, sizeof(BG(mblen_state)));
 #endif
 
-	BG(incomplete_class) = php_create_incomplete_class(TSRMLS_C);
+	BG(incomplete_class) = incomplete_class_entry;
 }
 
 
@@ -1022,6 +1024,8 @@ PHP_MINIT_FUNCTION(basic)
 #endif
 #endif
 
+	BG(incomplete_class) = incomplete_class_entry = php_create_incomplete_class(TSRMLS_C);
+
 	REGISTER_LONG_CONSTANT("CONNECTION_ABORTED", PHP_CONNECTION_ABORTED, CONST_CS | CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("CONNECTION_NORMAL",  PHP_CONNECTION_NORMAL,  CONST_CS | CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("CONNECTION_TIMEOUT", PHP_CONNECTION_TIMEOUT, CONST_CS | CONST_PERSISTENT);