MFH: fix bug #47353 (crash when creating a lot of objects in object destructor)

tony2001 · tony2001 · commit 4e2c0bc9050c · 2009-02-11T09:58:23.000Z
diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c
@@ -55,6 +55,7 @@ ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects TS
 				if (obj->dtor && obj->object) {
 					obj->refcount++;
 					obj->dtor(obj->object, i TSRMLS_CC);
+					obj = &objects->object_buckets[i].bucket.obj;
 					obj->refcount--;
 				}
 			}
@@ -208,6 +209,10 @@ ZEND_API void zend_objects_store_del_ref_by_handle_ex(zend_object_handle handle,
 					} zend_end_try();
 				}
 			}
+			
+			/* re-read the object from the object store as the store might have been reallocated in the dtor */
+			obj = &EG(objects_store).object_buckets[handle].bucket.obj;
+
 			if (obj->refcount == 1) {
 				GC_REMOVE_ZOBJ_FROM_BUFFER(obj);
 				if (obj->free_storage) {
@@ -251,6 +256,7 @@ ZEND_API zend_object_value zend_objects_store_clone_obj(zval *zobject TSRMLS_DC)
 	}
 
 	obj->clone(obj->object, &new_object TSRMLS_CC);
+	obj = &EG(objects_store).object_buckets[handle].bucket.obj;
 
 	retval.handle = zend_objects_store_put(new_object, obj->dtor, obj->free_storage, obj->clone TSRMLS_CC);
 	retval.handlers = Z_OBJ_HT_P(zobject);

Original file line number	Diff line number	Diff line change
`@@ -55,6 +55,7 @@ ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects TS`
`55`	`55`	`if (obj->dtor && obj->object) {`
`56`	`56`	`obj->refcount++;`
`57`	`57`	`obj->dtor(obj->object, i TSRMLS_CC);`
	`58`	`+ obj = &objects->object_buckets[i].bucket.obj;`
`58`	`59`	`obj->refcount--;`
`59`	`60`	`}`
`60`	`61`	`}`
`@@ -208,6 +209,10 @@ ZEND_API void zend_objects_store_del_ref_by_handle_ex(zend_object_handle handle,`
`208`	`209`	`} zend_end_try();`
`209`	`210`	`}`
`210`	`211`	`}`
	`212`	`+`
	`213`	`+ /* re-read the object from the object store as the store might have been reallocated in the dtor */`
	`214`	`+ obj = &EG(objects_store).object_buckets[handle].bucket.obj;`
	`215`	`+`
`211`	`216`	`if (obj->refcount == 1) {`
`212`	`217`	`GC_REMOVE_ZOBJ_FROM_BUFFER(obj);`
`213`	`218`	`if (obj->free_storage) {`
`@@ -251,6 +256,7 @@ ZEND_API zend_object_value zend_objects_store_clone_obj(zval *zobject TSRMLS_DC)`
`251`	`256`	`}`
`252`	`257`
`253`	`258`	`obj->clone(obj->object, &new_object TSRMLS_CC);`
	`259`	`+ obj = &EG(objects_store).object_buckets[handle].bucket.obj;`
`254`	`260`
`255`	`261`	`retval.handle = zend_objects_store_put(new_object, obj->dtor, obj->free_storage, obj->clone TSRMLS_CC);`
`256`	`262`	`retval.handlers = Z_OBJ_HT_P(zobject);`