Skip to content

Fix weakref notify reentrancy during object destruction (GH-20404) #20655

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rizwan3d wants to merge 3 commits into
base: master
Choose a base branch
from
+36 −3
Open

Fix weakref notify reentrancy during object destruction (GH-20404) #20655

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1a478b1
Fix weakref notify reentrancy during object destruction (GH-20404)
rizwan3d Dec 5, 2025
227f9fe
FIx: Initialize tagged_ptr in zend_weakrefs_notify
rizwan3d Dec 5, 2025
df8f88e
Handle missing weakref entries in zend_weakref_unregister
rizwan3d Dec 6, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions Zend/tests/weakrefs/gh20404_weakmap_dtor_reentrancy.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
--TEST--
GH-20404: Crash when adding object to WeakMap during destruction
--FILE--
<?php

$w = new WeakMap;

$o = new stdClass;
$w[$o] = new class($r) {
function __construct(public &$r) {}
function __destruct() {
global $refs;
$o = $this->r->get();
for ($i = 0; $i < 8; ++$i) {
$r = new WeakMap;
$r[$o] = 1;
$refs[] = $r;
}
}
};
$r = WeakReference::create($o);

echo "END OF SCRIPT\n";
?>
--EXPECT--
END OF SCRIPT
13 changes: 10 additions & 3 deletions Zend/zend_weakrefs.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,7 +125,13 @@ static void zend_weakref_register(zend_object *object, void *payload) {
static void zend_weakref_unregister(zend_object *object, void *payload, bool weakref_free) {
zend_ulong obj_key = zend_object_to_weakref_key(object);
void *tagged_ptr = zend_hash_index_find_ptr(&EG(weakrefs), obj_key);
ZEND_ASSERT(tagged_ptr && "Weakref not registered?");

if (!tagged_ptr) {
#if ZEND_DEBUG
ZEND_ASSERT("Weakref not registered?");
#endif
return;
}

void *ptr = ZEND_WEAKREF_GET_PTR(tagged_ptr);
uintptr_t tag = ZEND_WEAKREF_GET_TAG(tagged_ptr);
Expand Down Expand Up @@ -217,9 +223,10 @@ void zend_weakrefs_notify(zend_object *object) {
#if ZEND_DEBUG
ZEND_ASSERT(tagged_ptr && "Tracking of the IS_OBJ_WEAKLY_REFERENCE flag should be precise");
#endif
if (tagged_ptr) {
zend_weakref_unref(object, tagged_ptr);
while (tagged_ptr) {
zend_hash_index_del(&EG(weakrefs), obj_key);
zend_weakref_unref(object, tagged_ptr);
tagged_ptr = zend_hash_index_find_ptr(&EG(weakrefs), obj_key);
}
}

Expand Down
Loading