Fixed bug #38315 (Constructing in the destructor causes weird behaviour)

1 files changed, 10 insertions, 11 deletions

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 806a5d6f88..e5e127f0f5 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -571,15 +571,6 @@ static Bucket *zend_hash_apply_deleter(HashTable *ht, Bucket *p)
 	Bucket *retval;
 
 	HANDLE_BLOCK_INTERRUPTIONS();
-
-	if (ht->pDestructor) {
-		ht->pDestructor(p->pData);
-	}
-	if (p->pData != &p->pDataPtr) {
-		pefree(p->pData, ht->persistent);
-	}
-	retval = p->pListNext;
-
 	if (p->pLast) {
 		p->pLast->pNext = p->pNext;
 	} else {
@@ -608,9 +599,17 @@ static Bucket *zend_hash_apply_deleter(HashTable *ht, Bucket *p)
 	if (ht->pInternalPointer == p) {
 		ht->pInternalPointer = p->pListNext;
 	}
-	pefree(p, ht->persistent);
-	HANDLE_UNBLOCK_INTERRUPTIONS();
 	ht->nNumOfElements--;
+	HANDLE_UNBLOCK_INTERRUPTIONS();
+
+	if (ht->pDestructor) {
+		ht->pDestructor(p->pData);
+	}
+	if (p->pData != &p->pDataPtr) {
+		pefree(p->pData, ht->persistent);
+	}
+	retval = p->pListNext;
+	pefree(p, ht->persistent);
 
 	return retval;
 }