cvs: ZendEngine2 / zend_objects_API.c

tony2001		Wed Feb 11 09:58:14 2009 UTC

  Modified files:              
    /ZendEngine2	zend_objects_API.c 
  Log:
  fix bug #47353 (crash when creating a lot of objects in object destructor)
  
  
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_objects_API.c?r1=1.72&r2=1.73&diff_format=u
Index: ZendEngine2/zend_objects_API.c
diff -u ZendEngine2/zend_objects_API.c:1.72 ZendEngine2/zend_objects_API.c:1.73
--- ZendEngine2/zend_objects_API.c:1.72	Wed Dec 31 11:12:29 2008
+++ ZendEngine2/zend_objects_API.c	Wed Feb 11 09:58:13 2009
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend_objects_API.c,v 1.72 2008/12/31 11:12:29 sebastian Exp $ */
+/* $Id: zend_objects_API.c,v 1.73 2009/02/11 09:58:13 tony2001 Exp $ */
 
 #include "zend.h"
 #include "zend_globals.h"
@@ -57,6 +57,7 @@
 				if (obj->dtor && obj->object) {
 					obj->refcount++;
 					obj->dtor(obj->object, i TSRMLS_CC);
+					obj = &objects->object_buckets[i].bucket.obj;
 					obj->refcount--;
 				}
 			}
@@ -225,6 +226,10 @@
 					} zend_end_try();
 				}
 			}
+
+			/* re-read the object from the object store as the store might have been reallocated in the dtor */
+			obj = &EG(objects_store).object_buckets[handle].bucket.obj;
+
 			if (obj->refcount == 1) {
 				GC_REMOVE_ZOBJ_FROM_BUFFER(obj);
 				if (obj->free_storage) {
@@ -268,6 +273,7 @@
 	}
 
 	obj->clone(obj->object, &new_object TSRMLS_CC);
+	obj = &EG(objects_store).object_buckets[handle].bucket.obj;
 
 	retval.handle = zend_objects_store_put(new_object, obj->dtor, obj->free_storage, obj->clone TSRMLS_CC);
 	retval.handlers = Z_OBJ_HT_P(zobject);