archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fixed bug #63635 (Segfault in gc_collect_cycles)

Browse source
This commit is contained in:
Dmitry Stogov 2012-11-29 13:06:12 +04:00
parent bc7f2b5f41
commit 3c1888f584
2 changed files with 62 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

58
Zend/tests/bug63635.phpt Normal file
View file

@ -0,0 +1,58 @@
--TEST--
Bug #63635 (Segfault in gc_collect_cycles)
--FILE--
<?php
class Node {
public $parent = NULL;
public $childs = array();
function __construct(Node $parent=NULL) {
if ($parent) {
$parent->childs[] = $this;
}
$this->childs[] = $this;
}
function __destruct() {
$this->childs = NULL;
}
}
define("MAX", 16);
for ($n = 0; $n < 20; $n++) {
$top = new Node();
for ($i=0 ; $i<MAX ; $i++) {
$ci = new Node($top);
for ($j=0 ; $j<MAX ; $j++) {
$cj = new Node($ci);
for ($k=0 ; $k<MAX ; $k++) {
$ck = new Node($cj);
}
}
}
echo "$n\n";
}
echo "ok\n";
--EXPECT--
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
ok

6
Zend/zend_gc.c
View file

@ -644,7 +644,8 @@ tail_call:
struct _store_object *obj = &EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].bucket.obj;
if (obj->buffered == (gc_root_buffer*)GC_WHITE) {
GC_SET_BLACK(obj->buffered);
/* PURPLE instead of BLACK to prevent buffering in nested gc calls */
GC_SET_PURPLE(obj->buffered);
if (EXPECTED(EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].valid &&
(get_gc = Z_OBJ_HANDLER_P(pz, get_gc)) != NULL)) {
@ -715,7 +716,8 @@ static void zobj_collect_white(zval *pz TSRMLS_DC)
struct _store_object *obj = &EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].bucket.obj;
if (obj->buffered == (gc_root_buffer*)GC_WHITE) {
GC_SET_BLACK(obj->buffered);
/* PURPLE instead of BLACK to prevent buffering in nested gc calls */
GC_SET_PURPLE(obj->buffered);
if (EXPECTED(EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].valid &&
(get_gc = Z_OBJ_HANDLER_P(pz, get_gc)) != NULL)) {