diff --git a/NEWS b/NEWS index ad28347baa5..e583ef86bc0 100644 --- a/NEWS +++ b/NEWS @@ -5,6 +5,8 @@ PHP NEWS - Core: . Fixed GH-13569 (GC buffer unnecessarily grows up to GC_MAX_BUF_SIZE when scanning WeakMaps). (Arnaud) + . Fixed bug GH-13612 (Corrupted memory in destructor with weak references). + (nielsdos) - Gettext: . Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 diff --git a/Zend/tests/weakrefs/gh13612.phpt b/Zend/tests/weakrefs/gh13612.phpt new file mode 100644 index 00000000000..4ca4c925087 --- /dev/null +++ b/Zend/tests/weakrefs/gh13612.phpt @@ -0,0 +1,39 @@ +--TEST-- +GH-13612 (Corrupted memory in destructor with weak references) +--FILE-- +weakAnalysingMap = \WeakReference::create($analysingMap); + } + + public function __destruct() + { + var_dump($this->weakAnalysingMap->get()); + } + }; + + $this->destroyed[] = 1; + $this->ownerDestructorHandlers[] = $handler; + } +} + +new WeakAnalysingMapRepro(); + +echo "Done\n"; + +?> +--EXPECT-- +NULL +Done diff --git a/Zend/zend_objects.c b/Zend/zend_objects.c index 4c4b3cf30c1..af4d1f26589 100644 --- a/Zend/zend_objects.c +++ b/Zend/zend_objects.c @@ -50,6 +50,10 @@ ZEND_API void zend_object_std_dtor(zend_object *object) { zval *p, *end; + if (UNEXPECTED(GC_FLAGS(object) & IS_OBJ_WEAKLY_REFERENCED)) { + zend_weakrefs_notify(object); + } + if (object->properties) { if (EXPECTED(!(GC_FLAGS(object->properties) & IS_ARRAY_IMMUTABLE))) { if (EXPECTED(GC_DELREF(object->properties) == 0) @@ -88,10 +92,6 @@ ZEND_API void zend_object_std_dtor(zend_object *object) FREE_HASHTABLE(guards); } } - - if (UNEXPECTED(GC_FLAGS(object) & IS_OBJ_WEAKLY_REFERENCED)) { - zend_weakrefs_notify(object); - } } ZEND_API void zend_objects_destroy_object(zend_object *object)