Patch bug61998.patch for Reproducible crash Bug #61998

Patch version 2012-05-21 08:30 UTC

Obsolete patches:

• bug61998.patch, revision 2012-05-19 06:16 UTC

• 2012-05-21 08:30 UTC [diff to current]
• 2012-05-19 06:16 UTC [diff to current]

Developer: dmitry@zend.com

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 602b600..b7e7cd3 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -3619,6 +3619,7 @@ ZEND_API void zend_do_implement_trait(zend_class_entry *ce, zend_class_entry *tr
 			}
 		}
 		ce->traits[ce->num_traits++] = trait;
+		trait->refcount++;
 	}
 }
 /* }}} */
@@ -3870,8 +3871,8 @@ static int zend_traits_copy_functions(zend_function *fn TSRMLS_DC, int num_args,
 				fn_copy = *fn;
 				function_add_ref(&fn_copy);
 				/* this function_name is never destroyed, because its refcount
-				   greater than 1, classes are always destoyed in reverse order
-				   and trait is declared early than this class */
+				   greater than 1 and classes are always destoyed before the
+				   traits they use */
 				fn_copy.common.function_name = aliases[i]->alias;
 					
 				/* if it is 0, no modifieres has been changed */
diff --git a/Zend/zend_opcode.c b/Zend/zend_opcode.c
index 65fa851..2d76f6c 100644
--- a/Zend/zend_opcode.c
+++ b/Zend/zend_opcode.c
@@ -215,6 +215,12 @@ ZEND_API int zend_cleanup_class_data(zend_class_entry **pce TSRMLS_DC)
 void _destroy_zend_class_traits_info(zend_class_entry *ce)
 {
 	if (ce->num_traits > 0 && ce->traits) {
+		size_t i;
+		for (i = 0; i < ce->num_traits; i++) {
+			if (ce->traits[i]) {
+				destroy_zend_class(&ce->traits[i]);
+			}
+		}
 		efree(ce->traits);
 	}