summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorXinchen Hui <laruence@php.net>2013-06-05 17:30:09 +0800
committerXinchen Hui <laruence@php.net>2013-06-05 17:30:09 +0800
commite89537f2a349d5d1f401e010ec6f17cff4035719 (patch)
treeca8bc95e32a352eb4578f63a86e18c8240dd825d
parent785f4c5fc68422ae23c1acc37b823f214c52ca5d (diff)
parent3c93402f86bc0a0a9cdf87b480d8bb856e360059 (diff)
downloadphp-git-e89537f2a349d5d1f401e010ec6f17cff4035719.tar.gz
Merge branch 'PHP-5.4' into PHP-5.5
-rw-r--r--Zend/tests/bug64960.phpt40
-rw-r--r--Zend/zend_execute_API.c6
2 files changed, 42 insertions, 4 deletions
diff --git a/Zend/tests/bug64960.phpt b/Zend/tests/bug64960.phpt
new file mode 100644
index 0000000000..b31cca3dc6
--- /dev/null
+++ b/Zend/tests/bug64960.phpt
@@ -0,0 +1,40 @@
+--TEST--
+Bug #64960 (Segfault in gc_zval_possible_root)
+--FILE--
+<?php
+// this makes ob_end_clean raise an error
+ob_end_flush();
+
+class ExceptionHandler {
+ public function __invoke (Exception $e)
+ {
+ // this triggers the custom error handler
+ ob_end_clean();
+ }
+}
+
+// this must be a class, closure does not trigger segfault
+set_exception_handler(new ExceptionHandler());
+
+// exception must be throwed from error handler.
+set_error_handler(function()
+{
+ $e = new Exception;
+ $e->_trace = debug_backtrace();
+
+ throw $e;
+});
+
+// trigger error handler
+$a['waa'];
+?>
+--EXPECTF--
+Notice: ob_end_flush(): failed to delete and flush buffer. No buffer to delete or flush in %sbug64960.php on line 3
+
+Fatal error: Uncaught exception 'Exception' in %sbug64960.php:19
+Stack trace:
+#0 [internal function]: {closure}(8, 'ob_end_clean():...', '%s', 9, Array)
+#1 %sbug64960.php(9): ob_end_clean()
+#2 [internal function]: ExceptionHandler->__invoke(Object(Exception))
+#3 {main}
+ thrown in %sbug64960.php on line 19
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 8739e21c2b..d831b107a1 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -254,15 +254,13 @@ void shutdown_executor(TSRMLS_D) /* {{{ */
if (EG(user_error_handler)) {
zeh = EG(user_error_handler);
EG(user_error_handler) = NULL;
- zval_dtor(zeh);
- FREE_ZVAL(zeh);
+ zval_ptr_dtor(&zeh);
}
if (EG(user_exception_handler)) {
zeh = EG(user_exception_handler);
EG(user_exception_handler) = NULL;
- zval_dtor(zeh);
- FREE_ZVAL(zeh);
+ zval_ptr_dtor(&zeh);
}
zend_stack_destroy(&EG(user_error_handlers_error_reporting));