Skip to content

Commit 39993bc

Browse files
committed
Fix access on NULL when printing backtrace with freed generator
Fixes GH-15851
1 parent 422aa17 commit 39993bc

File tree

2 files changed

+39
-1
lines changed

2 files changed

+39
-1
lines changed

Zend/tests/gh15851.phpt

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
--TEST--
2+
GH-15851: Access on NULL when printing backtrace with freed generator
3+
--FILE--
4+
<?php
5+
6+
class Foo {
7+
public $obj;
8+
public $printBacktrace;
9+
10+
public function __destruct() {
11+
if ($this->printBacktrace) {
12+
debug_print_backtrace();
13+
}
14+
}
15+
}
16+
17+
function bar() {
18+
yield from foo();
19+
}
20+
21+
function foo() {
22+
// Default GC threshold
23+
for ($i = 0; $i < 10001; $i++) {
24+
$obj = new Foo();
25+
$obj->obj = $obj;
26+
$obj->printBacktrace = $i === 0;
27+
}
28+
29+
yield;
30+
}
31+
32+
$gen = bar();
33+
foreach ($gen as $dummy);
34+
35+
?>
36+
--EXPECTF--
37+
#0 %s(%d): Foo->__destruct()
38+
#1 %s(%d): unknown()

Zend/zend_builtin_functions.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1788,7 +1788,7 @@ ZEND_API void zend_fetch_debug_backtrace(zval *return_value, int skip_last, int
17881788
}
17891789

17901790
func = call->func;
1791-
if (!fake_frame && func->common.function_name) {
1791+
if (!fake_frame && func && func->common.function_name) {
17921792
ZVAL_STR_COPY(&tmp, func->common.function_name);
17931793
_zend_hash_append_ex(stack_frame, ZSTR_KNOWN(ZEND_STR_FUNCTION), &tmp, 1);
17941794

0 commit comments

Comments
 (0)