Fixed bug #51822i (Segfault with strange __destruct() for static class variables)

2 files changed, 44 insertions, 1 deletions

diff --git a/Zend/tests/bug51822.phpt b/Zend/tests/bug51822.phpt
new file mode 100644
index 0000000000..cffae7bb1a
--- /dev/null
+++ b/Zend/tests/bug51822.phpt
@@ -0,0 +1,40 @@
+--TEST--
+Bug #51822 (Segfault with strange __destruct() for static class variables)
+--FILE--
+<?php
+class DestructableObject
+{
+	public function __destruct()
+	{
+		echo "2\n";
+	}	
+}
+
+class DestructorCreator
+{
+	public function __destruct()
+	{
+		$this->test = new DestructableObject;	
+		echo "1\n";
+	}
+}
+
+class Test
+{
+	public static $mystatic;
+}
+
+// Uncomment this to avoid segfault
+//Test::$mystatic = new DestructorCreator();
+
+$x = new Test();
+
+if (!isset(Test::$mystatic))
+	Test::$mystatic = new DestructorCreator();
+
+echo "bla\n";
+?>
+--EXPECT--
+bla
+1
+2
diff --git a/Zend/zend_opcode.c b/Zend/zend_opcode.c
index 2a0cfd9941..74d247b32f 100644
--- a/Zend/zend_opcode.c
+++ b/Zend/zend_opcode.c
@@ -159,7 +159,10 @@ ZEND_API int zend_cleanup_class_data(zend_class_entry **pce TSRMLS_DC)
 		/* Note that only run-time accessed data need to be cleaned up, pre-defined data can
 		   not contain objects and thus are not probelmatic */
 		zend_hash_apply(&(*pce)->function_table, (apply_func_t) zend_cleanup_function_data_full TSRMLS_CC);
-		(*pce)->static_members = NULL;
+		if ((*pce)->static_members) {
+			zend_hash_clean((*pce)->static_members);
+			(*pce)->static_members = NULL;
+		}
 	} else if (CE_STATIC_MEMBERS(*pce)) {
 		zend_hash_destroy(CE_STATIC_MEMBERS(*pce));
 		FREE_HASHTABLE(CE_STATIC_MEMBERS(*pce));