Fixed bug #79821

HashTable was reallocated (zend_hash_packed_grow) during php_var_dump, so we should call GC_ADDREF to make SEPARATE_ARRAY work. Closes GH-5837.
php · Jul 10, 2020 · 150504e · 150504e
1 parent a72c53a
commit 150504e
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 0 deletions.
diff --git a/ext/standard/tests/bug79821.phpt b/ext/standard/tests/bug79821.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #79821 (array grow during var_dump)
+--FILE--
+<?php
+
+$foo = $bar = [];
+for ($i = 0; $i < 3; $i++) {
+    $foo = [$foo, [&$bar]];
+}
+ob_start(function (string $buffer) use (&$bar) {
+    $bar[][] = null;
+    return '';
+}, 1);
+var_dump($foo[0]);
+ob_end_clean();
+
+echo "OK\n";
+
+?>
+--EXPECT--
+OK
diff --git a/ext/standard/var.c b/ext/standard/var.c
@@ -122,6 +122,7 @@ PHPAPI void php_var_dump(zval *struc, int level) /* {{{ */
 					PUTS("*RECURSION*\n");
 					return;
 				}
+				GC_ADDREF(myht);
 				GC_PROTECT_RECURSION(myht);
 			}
 			count = zend_array_count(myht);
@@ -506,8 +507,10 @@ PHPAPI void php_var_export_ex(zval *struc, int level, smart_str *buf) /* {{{ */
 			ZEND_HASH_FOREACH_KEY_VAL_IND(myht, index, key, val) {
 				php_array_element_export(val, index, key, level, buf);
 			} ZEND_HASH_FOREACH_END();
+
 			if (!(GC_FLAGS(myht) & GC_IMMUTABLE)) {
 				GC_UNPROTECT_RECURSION(myht);
+				GC_DELREF(myht);
 			}
 			if (level > 1) {
 				buffer_append_spaces(buf, level - 1);