From 18f2918a0fcf66562a5e7d964188c188660e9728 Mon Sep 17 00:00:00 2001 From: Nikita Popov Date: Tue, 13 Aug 2019 09:51:29 +0200 Subject: Don't destroy properties array with unset GC type As the properties array can also be a GC root, it might have already been destroyed. --- Zend/zend_objects.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'Zend/zend_objects.c') diff --git a/Zend/zend_objects.c b/Zend/zend_objects.c index 11daa0646a..7a93c1bdb1 100644 --- a/Zend/zend_objects.c +++ b/Zend/zend_objects.c @@ -46,7 +46,8 @@ ZEND_API void zend_object_std_dtor(zend_object *object) if (object->properties) { if (EXPECTED(!(GC_FLAGS(object->properties) & IS_ARRAY_IMMUTABLE))) { - if (EXPECTED(--GC_REFCOUNT(object->properties) == 0)) { + if (EXPECTED(--GC_REFCOUNT(object->properties) == 0) + && EXPECTED(GC_TYPE(object->properties) != IS_NULL)) { zend_array_destroy(object->properties); } } -- cgit v1.2.1