cvs: ZendEngine2 / zend_API.c /tests bug47880.phpt

dmitry		Mon Apr  6 11:10:50 2009 UTC

  Modified files:              
    /ZendEngine2	zend_API.c 
    /ZendEngine2/tests	bug47880.phpt 
  Log:
  Bug #47880 (crashes in call_user_func_array())
  
  
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_API.c?r1=1.499&r2=1.500&diff_format=u
Index: ZendEngine2/zend_API.c
diff -u ZendEngine2/zend_API.c:1.499 ZendEngine2/zend_API.c:1.500
--- ZendEngine2/zend_API.c:1.499	Thu Apr  2 09:56:53 2009
+++ ZendEngine2/zend_API.c	Mon Apr  6 11:10:50 2009
@@ -18,7 +18,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: zend_API.c,v 1.499 2009/04/02 09:56:53 dmitry Exp $ */
+/* $Id: zend_API.c,v 1.500 2009/04/06 11:10:50 dmitry Exp $ */
 
 #include "zend.h"
 #include "zend_execute.h"
@@ -3270,9 +3270,6 @@
 ZEND_API void zend_fcall_info_args_clear(zend_fcall_info *fci, int free_mem) /* {{{ */
 {
 	if (fci->params) {
-		while (fci->param_count) {
-			zval_ptr_dtor(fci->params[--fci->param_count]);
-		}
 		if (free_mem) {
 			efree(fci->params);
 			fci->params = NULL;
@@ -3320,7 +3317,6 @@
 	zend_hash_internal_pointer_reset_ex(Z_ARRVAL_P(args), &pos);
 	while (zend_hash_get_current_data_ex(Z_ARRVAL_P(args), (void *) &arg, &pos) == SUCCESS) {
 		*params++ = arg;
-		Z_ADDREF_P(*arg);
 		zend_hash_move_forward_ex(Z_ARRVAL_P(args), &pos);
 	}
 
@@ -3343,7 +3339,6 @@
 		fci->params = (zval ***) erealloc(fci->params, fci->param_count * sizeof(zval **));
 
 		for (i = 0; i < argc; ++i) {
-			Z_ADDREF_P(*(argv[i]));
 			fci->params[i] = argv[i];
 		}
 	}
@@ -3369,7 +3364,6 @@
 
 		for (i = 0; i < argc; ++i) {
 			arg = va_arg(*argv, zval **);
-			Z_ADDREF_P(*arg);
 			fci->params[i] = arg;
 		}
 	}
http://cvs.php.net/viewvc.cgi/ZendEngine2/tests/bug47880.phpt?r1=1.1&r2=1.2&diff_format=u
Index: ZendEngine2/tests/bug47880.phpt
diff -u /dev/null ZendEngine2/tests/bug47880.phpt:1.2
--- /dev/null	Mon Apr  6 11:10:50 2009
+++ ZendEngine2/tests/bug47880.phpt	Mon Apr  6 11:10:50 2009
@@ -0,0 +1,15 @@
+--TEST--
+Bug #47880 (crashes in call_user_func_array())
+--FILE--
+<?php
+class bomb {
+  static function go($n)	{
+   $backtrace = debug_backtrace(false);
+   $backtrace[1]['args'][1] = 'bomb';
+  }
+}
+call_user_func_array(array('bomb', 'go'), array(0));
+echo "ok\n";
+?>
+--EXPECT--
+ok