* PHP-5.6:
update NEWS
Only destruct if EG(active) in zend_shutdown(). (bug #65463, #66036)
Fix typo from commit 32314f6b6
Fix destruction order in zend_shutdown (bug #65463, #66036)
Conflicts:
Zend/zend_compile.h
Zend/zend_execute_API.c
* PHP-5.5:
update NEWS
Only destruct if EG(active) in zend_shutdown(). (bug #65463, #66036)
Fix typo from commit 32314f6b6
Fix destruction order in zend_shutdown (bug #65463, #66036)
* PHP-5.4:
update NEWS
Only destruct if EG(active) in zend_shutdown(). (bug #65463, #66036)
Fix typo from commit 32314f6b6
Fix destruction order in zend_shutdown (bug #65463, #66036)
* pull-request/770:
Only destruct if EG(active) in zend_shutdown(). (bug #65463, #66036)
Fix typo from commit 32314f6b6
Fix destruction order in zend_shutdown (bug #65463, #66036)
Now one common stack to handle both, which stores znodes instead of
full oplines (foreach copy stack) or switch entries (switch cond
stack).
Also removed EG(start_op) while at it.
As far as I can discern these are leftovers of the interactive
shell implementation that was used before PHP 5.4. Now the readline
ext makes use of normal eval calls for this.
So, dropping these until there is evidence to the contrary, as they
currently wouldn't work anyway.
If Apache or a similar SAPI receives a signal during PHP processing
it calls zend_shutdown() without calling shutdown_executor().
#65463: If a module like Gearman or Memcached is loaded,
in the unfixed version it is unloaded by zend_destroy_modules() before the
CG(CLASS_TABLE) is destructed. When CG(CLASS_TABLE) is destructed,
any pointers to methods (specifically around destruction) in the unloaded
module's .so are now dangling and the process segfaults.
#66036: Any subclasses of an internal class like ArrayObject need
to be destructed in order: subclass first and then the internal class. In the
unfixed version zend_shutdown() clears the CG(CLASS_TABLE) from the head
of the list onwards, so internal classes are destructed first and user-defined
classes last. Internal classes are alloc/deallocated with malloc/free while
user-defined classes with emalloc/efree. If there's shared data between them
then efree() could be called instead of free() leading to a seg-fault.
This issue was originally hacked around in zend_make_printable_zval.
I've now moved the overridden __toString() handling into the SXE
cast_object handler, so everything invoking that handler
(zend_make_printable_zval, convert_to_string, zval_get_string,
and various other more obscure usages) see the same behavior.
