2 files changed, 15 insertions, 55 deletions

diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
index c6eec945e9..22d4ffa134 100755
--- a/ext/spl/spl_directory.c
+++ b/ext/spl/spl_directory.c
@@ -120,16 +120,6 @@ static void spl_filesystem_object_free_storage(void *object TSRMLS_DC) /* {{{ */
 		spl_filesystem_file_free_line(intern TSRMLS_CC);
 		break;
 	}
-
-	{
-		zend_object_iterator *iterator;
-		iterator = (zend_object_iterator*)
-				spl_filesystem_object_to_iterator(intern);
-		if (iterator->data != NULL) {
-			iterator->data = NULL;
-			iterator->funcs->dtor(iterator TSRMLS_CC);
-		}
-	}
 	efree(object);
 } /* }}} */
 
@@ -1648,15 +1638,10 @@ zend_object_iterator *spl_filesystem_dir_get_iterator(zend_class_entry *ce, zval
 	dir_object = (spl_filesystem_object*)zend_object_store_get_object(object TSRMLS_CC);
 	iterator   = spl_filesystem_object_to_iterator(dir_object);
 
-	/* initialize iterator if it wasn't gotten before */
-	if (iterator->intern.data == NULL) {
-		iterator->intern.data = object;
-		iterator->intern.funcs = &spl_filesystem_dir_it_funcs;
-		/* ->current must be initialized; rewind doesn't set it and valid
-		 * doesn't check whether it's set */
-		iterator->current = object;
-	}
-	zval_add_ref(&object);
+	Z_SET_REFCOUNT_P(object, Z_REFCOUNT_P(object) + 2);
+	iterator->intern.data = (void*)object;
+	iterator->intern.funcs = &spl_filesystem_dir_it_funcs;
+	iterator->current = object;
 	
 	return (zend_object_iterator*)iterator;
 }
@@ -1735,15 +1720,15 @@ static void spl_filesystem_dir_it_rewind(zend_object_iterator *iter TSRMLS_DC)
 static void spl_filesystem_tree_it_dtor(zend_object_iterator *iter TSRMLS_DC)
 {
 	spl_filesystem_iterator *iterator = (spl_filesystem_iterator *)iter;
+	zval *zfree = (zval*)iterator->intern.data;
 
-	if (iterator->intern.data) {
-		zval *object = 	iterator->intern.data;
-		zval_ptr_dtor(&object);
-	} else {
-		if (iterator->current) {
-			zval_ptr_dtor(&iterator->current);
-		}
+	if (iterator->current) {
+		zval_ptr_dtor(&iterator->current);
 	}
+	iterator->intern.data = NULL; /* mark as unused */
+	/* free twice as we add ref twice */
+	zval_ptr_dtor(&zfree);
+	zval_ptr_dtor(&zfree);
 }
 /* }}} */
 
@@ -1854,12 +1839,10 @@ zend_object_iterator *spl_filesystem_tree_get_iterator(zend_class_entry *ce, zva
 	dir_object = (spl_filesystem_object*)zend_object_store_get_object(object TSRMLS_CC);
 	iterator   = spl_filesystem_object_to_iterator(dir_object);
 
-	/* initialize iterator if wasn't gotten before */
-	if (iterator->intern.data == NULL) {
-		iterator->intern.data = object;
-		iterator->intern.funcs = &spl_filesystem_tree_it_funcs;
-	}
-	zval_add_ref(&object);
+	Z_SET_REFCOUNT_P(object, Z_REFCOUNT_P(object) + 2);
+	iterator->intern.data = (void*)object;
+	iterator->intern.funcs = &spl_filesystem_tree_it_funcs;
+	iterator->current = NULL;
 	
 	return (zend_object_iterator*)iterator;
 }
diff --git a/ext/spl/tests/bug61418.phpt b/ext/spl/tests/bug61418.phpt
deleted file mode 100644
index c5d9db9484..0000000000
--- a/ext/spl/tests/bug61418.phpt
+++ /dev/null
@@ -1,23 +0,0 @@
---TEST--
-Bug #61418: Segmentation fault using FiltesystemIterator & RegexIterator
---FILE--
-<?php
-$fileIterator = new FilesystemIterator(__DIR__, FilesystemIterator::KEY_AS_FILENAME);
-$regexpIterator = new RegexIterator($fileIterator, '#.*#');
-foreach ($fileIterator as $key => $file)
-{
-}
-unset($regexpIterator);
-unset($fileIterator);
-
-$dirIterator = new DirectoryIterator(__DIR__);
-$regexpIterator2 = new RegexIterator($dirIterator, '#.*#');
-foreach ($dirIterator as $key => $file)
-{
-}
-unset($regexpIterator2);
-unset($dirIterator);
-?>
-==DONE==
---EXPECT--
-==DONE==