Keeping consistent arg_stack during arguments freeing (Exception from destructor may use inconsistent arg_stack for backtrace).

2 files changed, 10 insertions, 4 deletions

diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
index bf75789423..c544badf04 100644
--- a/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@ -1708,9 +1708,13 @@ static zval *debug_backtrace_get_args(void ***curpos TSRMLS_DC)
 
 	while (--arg_count >= 0) {
 		arg = (zval **) p++;
-		SEPARATE_ZVAL_TO_MAKE_IS_REF(arg);
-		(*arg)->refcount++;
-		add_next_index_zval(arg_array, *arg);
+		if (*arg) {
+			SEPARATE_ZVAL_TO_MAKE_IS_REF(arg);
+			(*arg)->refcount++;
+			add_next_index_zval(arg_array, *arg);
+		} else {
+			add_next_index_null(arg_array);
+		}
 	}
 
 	/* skip args from incomplete frames */
diff --git a/Zend/zend_execute.h b/Zend/zend_execute.h
index 74773f2036..09432f77b4 100644
--- a/Zend/zend_execute.h
+++ b/Zend/zend_execute.h
@@ -152,7 +152,9 @@ static inline void zend_ptr_stack_clear_multiple(TSRMLS_D)
 
 	EG(argument_stack).top -= (delete_count+2);
 	while (--delete_count>=0) {
-		zval_ptr_dtor((zval **) --p);
+		zval *q = *(zval **)(--p);
+		*p = NULL;
+		zval_ptr_dtor(&q);
 	}
 	EG(argument_stack).top_element = p;
 }