mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-23 18:04:36 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.2' into PHP-8.3

Browse Source 
* PHP-8.2:
  [ci skip] NEWS
  Fix GH-13612: Corrupted memory in destructor with weak references
This commit is contained in:
Niels Dossche 2024-03-08 18:27:10 +01:00
commit 3fba242124
3 changed files with 45 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -5,6 +5,8 @@ PHP NEWS
- Core:
. Fixed GH-13569 (GC buffer unnecessarily grows up to GC_MAX_BUF_SIZE when
scanning WeakMaps). (Arnaud)
. Fixed bug GH-13612 (Corrupted memory in destructor with weak references).
(nielsdos)
- Gettext:
. Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5

39
Zend/tests/weakrefs/gh13612.phpt Normal file
View File

@ -0,0 +1,39 @@
--TEST--
GH-13612 (Corrupted memory in destructor with weak references)
--FILE--
<?php
class WeakAnalysingMapRepro
{
public array $destroyed = [];
public array $ownerDestructorHandlers = [];
public function __construct()
{
$handler = new class($this) {
private \WeakReference $weakAnalysingMap;
public function __construct(WeakAnalysingMapRepro $analysingMap)
{
$this->weakAnalysingMap = \WeakReference::create($analysingMap);
}
public function __destruct()
{
var_dump($this->weakAnalysingMap->get());
}
};
$this->destroyed[] = 1;
$this->ownerDestructorHandlers[] = $handler;
}
}
new WeakAnalysingMapRepro();
echo "Done\n";
?>
--EXPECT--
NULL
Done

8
Zend/zend_objects.c
View File

@ -50,6 +50,10 @@ ZEND_API void zend_object_std_dtor(zend_object *object)
{
zval *p, *end;
if (UNEXPECTED(GC_FLAGS(object) & IS_OBJ_WEAKLY_REFERENCED)) {
zend_weakrefs_notify(object);
}
if (object->properties) {
if (EXPECTED(!(GC_FLAGS(object->properties) & IS_ARRAY_IMMUTABLE))) {
if (EXPECTED(GC_DELREF(object->properties) == 0)
@ -88,10 +92,6 @@ ZEND_API void zend_object_std_dtor(zend_object *object)
FREE_HASHTABLE(guards);
}
}
if (UNEXPECTED(GC_FLAGS(object) & IS_OBJ_WEAKLY_REFERENCED)) {
zend_weakrefs_notify(object);
}
}
ZEND_API void zend_objects_destroy_object(zend_object *object)