Fixed bug #76536 (PHP crashes with core dump when throwing exception in error handler). (Laruence)

Author: laruence

NEWS

@@ -18,6 +18,10 @@ PHP                                                                        NEWS
 - phpdbg:
   . Fix arginfo wrt. optional/required parameters. (cmb)
 
+- Reflection:
+  . Fixed bug #76536 (PHP crashes with core dump when throwing exception in
+    error handler). (Laruence)
+
 - Standard:
   . Fixed bug #76505 (array_merge_recursive() is duplicating sub-array keys).
     (Laruence)

ext/reflection/php_reflection.c

@@ -4617,7 +4617,7 @@ ZEND_METHOD(reflection_class, getConstants)
 	ZEND_HASH_FOREACH_STR_KEY_PTR(&ce->constants_table, key, c) {
 		if (UNEXPECTED(zval_update_constant_ex(&c->value, ce) != SUCCESS)) {
 			zend_array_destroy(Z_ARRVAL_P(return_value));
-			return;
+			RETURN_NULL();
 		}
 		val = zend_hash_add_new(Z_ARRVAL_P(return_value), key, &c->value);
 		Z_TRY_ADDREF_P(val);

ext/reflection/tests/bug76536.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #76536 (PHP crashes with core dump when throwing exception in error handler)
+--FILE--
+<?php
+class SomeConstants {const SOME_CONSTANT = SOME_NONSENSE;}
+
+function handleError() {throw new ErrorException();}
+
+set_error_handler('handleError');
+set_exception_handler('handleError');
+
+$r = new \ReflectionClass(SomeConstants::class);
+$r->getConstants();
+?>
+--EXPECTF--
+Fatal error: Uncaught ErrorException in %sbug76536.php:%d
+Stack trace:
+#0 [internal function]: handleError(Object(ErrorException))
+#1 {main}
+  thrown in %sbug76536.php on line %d