Skip to content

Commit

Permalink
Make weak ref notify robust against bailout
Browse files Browse the repository at this point in the history
First drop it from EG(weakrefs), as the weakref_unref operation
may call a destructor, which may bail out.

Fixes oss-fuzz #39718.
  • Loading branch information
nikic committed Oct 8, 2021
1 parent d001682 commit a4b209f
Show file tree
Hide file tree
Showing 2 changed files with 19 additions and 1 deletion.
18 changes: 18 additions & 0 deletions Zend/tests/weakrefs/weakmap_dtor_exception.phpt
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
--TEST--
Exception during WeakMap destruction during shutdown
--FILE--
<?php
$map = new WeakMap;
$obj = new stdClass;
$map[$obj] = new class {
function __destruct() {
throw new Exception("Test");
}
};
?>
--EXPECTF--
Fatal error: Uncaught Exception: Test in %s:%d
Stack trace:
#0 [internal function]: class@anonymous->__destruct()
#1 {main}
thrown in %s on line %d
2 changes: 1 addition & 1 deletion Zend/zend_weakrefs.c
Original file line number Diff line number Diff line change
Expand Up @@ -157,8 +157,8 @@ void zend_weakrefs_notify(zend_object *object) {
ZEND_ASSERT(tagged_ptr && "Tracking of the IS_OBJ_WEAKLY_REFERENCE flag should be precise");
#endif
if (tagged_ptr) {
zend_weakref_unref(obj_addr, tagged_ptr);
zend_hash_index_del(&EG(weakrefs), obj_addr);
zend_weakref_unref(obj_addr, tagged_ptr);
}
}

Expand Down

0 comments on commit a4b209f

Please sign in to comment.