diff --git a/ext/spl/spl_heap.c b/ext/spl/spl_heap.c index a92707bd932..c4857663e76 100644 --- a/ext/spl/spl_heap.c +++ b/ext/spl/spl_heap.c @@ -249,9 +249,10 @@ static void spl_ptr_heap_insert(spl_ptr_heap *heap, zval *elem, void *cmp_userda } /* sifting up */ - for (i = heap->count++; i > 0 && heap->cmp(&heap->elements[(i-1)/2], elem, cmp_userdata) < 0; i = (i-1)/2) { + for (i = heap->count; i > 0 && heap->cmp(&heap->elements[(i-1)/2], elem, cmp_userdata) < 0; i = (i-1)/2) { heap->elements[i] = heap->elements[(i-1)/2]; } + heap->count++; if (EG(exception)) { /* exception thrown during comparison */ diff --git a/ext/spl/tests/bug69737.phpt b/ext/spl/tests/bug69737.phpt new file mode 100644 index 00000000000..d39ce3d4a82 --- /dev/null +++ b/ext/spl/tests/bug69737.phpt @@ -0,0 +1,16 @@ +--TEST-- +Bug #69737 (Segfault when SplMinHeap::compare produces fatal error) +--FILE-- +insert(1); +$h->insert(6); +?> +===DONE=== +--EXPECTF-- +Fatal error: Call to undefined method SplMinHeap::notexist() in %s/bug69737.php on line %d