Make weak ref notify robust against bailout

First drop it from EG(weakrefs), as the weakref_unref operation
may call a destructor, which may bail out.

Fixes oss-fuzz #39718.
This commit is contained in:
Nikita Popov 2021-10-08 16:42:43 +02:00
parent d001682ac4
commit a4b209fdcf
2 changed files with 19 additions and 1 deletions

View File

@ -0,0 +1,18 @@
--TEST--
Exception during WeakMap destruction during shutdown
--FILE--
<?php
$map = new WeakMap;
$obj = new stdClass;
$map[$obj] = new class {
function __destruct() {
throw new Exception("Test");
}
};
?>
--EXPECTF--
Fatal error: Uncaught Exception: Test in %s:%d
Stack trace:
#0 [internal function]: class@anonymous->__destruct()
#1 {main}
thrown in %s on line %d

View File

@ -157,8 +157,8 @@ void zend_weakrefs_notify(zend_object *object) {
ZEND_ASSERT(tagged_ptr && "Tracking of the IS_OBJ_WEAKLY_REFERENCE flag should be precise");
#endif
if (tagged_ptr) {
zend_weakref_unref(obj_addr, tagged_ptr);
zend_hash_index_del(&EG(weakrefs), obj_addr);
zend_weakref_unref(obj_addr, tagged_ptr);
}
}