Fixed segfault in Zend/tests/008.phpt

laruence · laruence · commit cc15eb500ed9 · 2014-02-20T16:21:41.000+08:00
diff --git a/Zend/zend_gc.h b/Zend/zend_gc.h
@@ -140,6 +140,12 @@ END_EXTERN_C()
 		} \
 	} while (0)
 
+#define GC_REMOVE_ZOBJ_FROM_BUFFER(z) do { \
+		if (GC_ADDRESS((z)->gc.u.v.buffer)) { \
+			gc_remove_zval_from_buffer(&(z)->gc TSRMLS_CC); \
+		} \
+	} while (0)
+
 static zend_always_inline void gc_zval_check_possible_root(zval *z TSRMLS_DC)
 {
 	if (Z_TYPE_P(z) == IS_ARRAY || Z_TYPE_P(z) == IS_OBJECT) {
diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c
@@ -55,7 +55,7 @@ ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects TS
 				obj->gc.refcount--;
 
 				if (obj->gc.refcount == 0) {
-					gc_remove_zval_from_buffer((zend_refcounted*)obj TSRMLS_CC);
+					GC_REMOVE_ZOBJ_FROM_BUFFER(obj TSRMLS_CC);
 				}
 			}
 		}
@@ -86,7 +86,7 @@ ZEND_API void zend_objects_store_free_object_storage(zend_objects_store *objects
 		zend_object *obj = objects->object_buckets[i];
 
 		if (IS_VALID(obj)) {
-			gc_remove_zval_from_buffer((zend_refcounted*)obj TSRMLS_CC);
+			GC_REMOVE_ZOBJ_FROM_BUFFER(obj TSRMLS_CC);
 			objects->object_buckets[i] = SET_INVALID(obj);
 			if (obj->handlers->free_obj) {
 				obj->handlers->free_obj(obj TSRMLS_CC);

Original file line number	Diff line number	Diff line change
`@@ -55,7 +55,7 @@ ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects TS`
`55`	`55`	`obj->gc.refcount--;`
`56`	`56`
`57`	`57`	`if (obj->gc.refcount == 0) {`
`58`		`- gc_remove_zval_from_buffer((zend_refcounted*)obj TSRMLS_CC);`
	`58`	`+ GC_REMOVE_ZOBJ_FROM_BUFFER(obj TSRMLS_CC);`
`59`	`59`	`}`
`60`	`60`	`}`
`61`	`61`	`}`
`@@ -86,7 +86,7 @@ ZEND_API void zend_objects_store_free_object_storage(zend_objects_store *objects`
`86`	`86`	`zend_object *obj = objects->object_buckets[i];`
`87`	`87`
`88`	`88`	`if (IS_VALID(obj)) {`
`89`		`- gc_remove_zval_from_buffer((zend_refcounted*)obj TSRMLS_CC);`
	`89`	`+ GC_REMOVE_ZOBJ_FROM_BUFFER(obj TSRMLS_CC);`
`90`	`90`	`objects->object_buckets[i] = SET_INVALID(obj);`
`91`	`91`	`if (obj->handlers->free_obj) {`
`92`	`92`	`obj->handlers->free_obj(obj TSRMLS_CC);`