diff options
| -rw-r--r-- | Zend/tests/array_splice_empty_ht_iter_removal.phpt | 15 | ||||
| -rw-r--r-- | Zend/zend_hash.c | 2 |
2 files changed, 16 insertions, 1 deletions
diff --git a/Zend/tests/array_splice_empty_ht_iter_removal.phpt b/Zend/tests/array_splice_empty_ht_iter_removal.phpt new file mode 100644 index 0000000000..1461827bc9 --- /dev/null +++ b/Zend/tests/array_splice_empty_ht_iter_removal.phpt @@ -0,0 +1,15 @@ +--TEST-- +HT iterator should be destroyed if array becomes empty during array_splice +--FILE-- +<?php +$a=[4]; +$i = 0; +foreach ($a as &$r) { + var_dump($r); + $a = array_splice($a, 0); + if (++$i == 2) break; +} +?> +--EXPECT-- +int(4) +int(4) diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c index 6d065cd03e..a3b62160dc 100644 --- a/Zend/zend_hash.c +++ b/Zend/zend_hash.c @@ -1655,10 +1655,10 @@ ZEND_API void ZEND_FASTCALL zend_array_destroy(HashTable *ht) } else if (EXPECTED(HT_FLAGS(ht) & HASH_FLAG_UNINITIALIZED)) { goto free_ht; } - zend_hash_iterators_remove(ht); SET_INCONSISTENT(HT_DESTROYED); efree(HT_GET_DATA_ADDR(ht)); free_ht: + zend_hash_iterators_remove(ht); FREE_HASHTABLE(ht); } |