Fixed bug #36006 (Problem with $this in __destruct())

git-svn-id: http://svn.php.net/repository/php/php-src/php/php-src/branches/PHP_5_0@205370 c90b9560-bf6c-de11-be94-00142212c4b1

Author: dmitry

NEWS

@@ -4,6 +4,7 @@ PHP                                                                        NEWS
 - Fixed an error in mysqli_fetch_fields (returned NULL instead of an
   array when row number > field_count). (Georg)
 - Renamed CachingRecursiveIterator to RecursiveCachingIterator. (Marcus)
+- Fixed bug #36006 (Problem with $this in __destruct()). (Dmitry)
 - Fixed bug #35612 (iis6 Access Violation crash). (Dmitry, alacn.uhahaa)
 - Fixed bug #35570 (segfault when re-using soap client object). (Dmitry)
 - FIxed bug #35536 (mysql_field_type() doesn't handle NEWDECIMAL). (Tony)

Zend/tests/bug36006.phpt

@@ -0,0 +1,30 @@
+--TEST--
+Bug #36006 (Problem with $this in __destruct())
+--FILE--
+<?php
+
+class Person {
+	public $dad;
+	public function __destruct() {
+		$this->dad = null; /* no segfault if this is commented out */
+	}
+}
+
+class Dad extends Person {
+	public $son;
+	public function __construct() {
+		$this->son = new Person;
+		$this->son->dad = $this; /* no segfault if this is commented out */
+	}
+	public function __destruct() {
+		$this->son = null;
+		parent::__destruct(); /* segfault here */
+	}
+}
+
+$o = new Dad;
+unset($o);
+echo "ok\n";
+?>
+--EXPECT--
+ok

Zend/zend_objects_API.c

@@ -52,7 +52,9 @@ ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects TS
 			if (!objects->object_buckets[i].destructor_called) {
 				objects->object_buckets[i].destructor_called = 1;
 				if (obj->dtor) {
+					obj->refcount++;
 					obj->dtor(obj->object, i TSRMLS_CC);
+					obj->refcount--;
 				}
 			}
 		}