diff options
| -rw-r--r-- | Zend/tests/gc_032.phpt | 40 | ||||
| -rw-r--r-- | Zend/zend_execute.c | 2 |
2 files changed, 41 insertions, 1 deletions
diff --git a/Zend/tests/gc_032.phpt b/Zend/tests/gc_032.phpt new file mode 100644 index 0000000000..615b008e65 --- /dev/null +++ b/Zend/tests/gc_032.phpt @@ -0,0 +1,40 @@ +--TEST-- +GC 032: Crash in GC because of invalid reference counting +--FILE-- +<?php +$a = array(); +$b =& $a; +$a[0] = $a; +debug_zval_dump($a); +$a = array(array()); +$b =& $a; +$a[0][0] = $a; +debug_zval_dump($a); +?> +--EXPECT-- +array(1) refcount(1){ + [0]=> + array(1) refcount(3){ + [0]=> + array(1) refcount(3){ + [0]=> + *RECURSION* + } + } +} +array(1) refcount(1){ + [0]=> + array(1) refcount(3){ + [0]=> + array(1) refcount(1){ + [0]=> + array(1) refcount(3){ + [0]=> + array(1) refcount(1){ + [0]=> + *RECURSION* + } + } + } + } +} diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 5ddb03a8c3..2d9a8cdd58 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -714,8 +714,8 @@ static inline zval* zend_assign_to_variable(zval **variable_ptr_ptr, zval *value ALLOC_ZVAL(variable_ptr); *variable_ptr_ptr = variable_ptr; *variable_ptr = *value; - zval_copy_ctor(variable_ptr); Z_SET_REFCOUNT_P(variable_ptr, 1); + zval_copy_ctor(variable_ptr); } else { *variable_ptr_ptr = value; Z_ADDREF_P(value); |