diff options
Diffstat (limited to 'Zend/zend_objects_API.c')
| -rw-r--r-- | Zend/zend_objects_API.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c index f757f282bc..3389b64608 100644 --- a/Zend/zend_objects_API.c +++ b/Zend/zend_objects_API.c @@ -152,14 +152,17 @@ ZEND_API void ZEND_FASTCALL zend_objects_store_put(zend_object *object) ZEND_API void ZEND_FASTCALL zend_objects_store_del(zend_object *object) /* {{{ */ { + ZEND_ASSERT(GC_REFCOUNT(object) == 0); + + /* GC might have released this object already. */ + if (UNEXPECTED(GC_TYPE(object) == IS_NULL)) { + return; + } + /* Make sure we hold a reference count during the destructor call otherwise, when the destructor ends the storage might be freed when the refcount reaches 0 a second time */ - ZEND_ASSERT(EG(objects_store).object_buckets != NULL); - ZEND_ASSERT(IS_OBJ_VALID(EG(objects_store).object_buckets[object->handle])); - ZEND_ASSERT(GC_REFCOUNT(object) == 0); - if (!(OBJ_FLAGS(object) & IS_OBJ_DESTRUCTOR_CALLED)) { GC_ADD_FLAGS(object, IS_OBJ_DESTRUCTOR_CALLED); @@ -176,6 +179,8 @@ ZEND_API void ZEND_FASTCALL zend_objects_store_del(zend_object *object) /* {{{ * uint32_t handle = object->handle; void *ptr; + ZEND_ASSERT(EG(objects_store).object_buckets != NULL); + ZEND_ASSERT(IS_OBJ_VALID(EG(objects_store).object_buckets[object->handle])); EG(objects_store).object_buckets[handle] = SET_OBJ_INVALID(object); if (!(OBJ_FLAGS(object) & IS_OBJ_FREE_CALLED)) { GC_ADD_FLAGS(object, IS_OBJ_FREE_CALLED); |