Fix wron behavior when reference get deleted durin notifier call

Author: pinepain

php_ref_reference.c

@@ -122,12 +122,14 @@ static void php_ref_call_notifiers(HashTable *references, zval *exceptions, zval
         }
 
         if (IS_NULL == Z_TYPE(reference->notifier)) {
-            /* no notifier set*/
+            /* notifier is not set */
             break;
         }
 
-        /* callback notifier */
+        /* WeakRef could be destroyed during notifier call, so we need to increment decrement refcount to survive */
+        Z_ADDREF(reference->this_ptr);
         php_ref_reference_call_notifier(&reference->this_ptr, &reference->notifier);
+        Z_DELREF(reference->this_ptr);
 
         if (EG(exception)) {
             php_ref_store_exceptions(exceptions, tmp);

tests/002-WeakReference-clone.phpt

@@ -97,7 +97,7 @@ object(Ref\WeakReference)#5 (2) refcount(3){
 
 Weak references reported with cloned reference: ok
 
-Notified: object(Ref\WeakReference)#5 (2) refcount(6){
+Notified: object(Ref\WeakReference)#5 (2) refcount(7){
   ["referent":"Ref\AbstractReference":private]=>
   NULL
   ["notifier":"Ref\AbstractReference":private]=>
@@ -115,7 +115,7 @@ Notified: object(Ref\WeakReference)#5 (2) refcount(6){
     }
   }
 }
-Notified: object(Ref\WeakReference)#4 (2) refcount(6){
+Notified: object(Ref\WeakReference)#4 (2) refcount(7){
   ["referent":"Ref\AbstractReference":private]=>
   NULL
   ["notifier":"Ref\AbstractReference":private]=>

tests/002-WeakReference-reference-deleted-during-notifier.phpt

@@ -0,0 +1,62 @@
+--TEST--
+Ref\WeakReference - reference deleted during notifier call
+--SKIPIF--
+<?php if (!extension_loaded("ref")) print "skip"; ?>
+--FILE--
+<?php
+
+use Ref\WeakReference;
+
+class Test
+{
+    public $storage = [];
+
+    public function put($key, $value, string $hash)
+    {
+        $key = new WeakReference($key, function () use ($hash) {
+            echo __METHOD__, PHP_EOL;
+            var_dump($this);
+            unset($this->storage[$hash]);
+            var_dump($this);
+        });
+
+        $this->storage[$hash] = $key;
+    }
+}
+
+$map = new Test();
+
+$key_1   = new stdClass();
+$value_1 = new stdClass();
+
+$map->put($key_1, $value_1, 'test');
+
+$key_1 = null;
+?>
+--EXPECT--
+{closure}
+object(Test)#1 (1) {
+  ["storage"]=>
+  array(1) {
+    ["test"]=>
+    object(Ref\WeakReference)#4 (2) {
+      ["referent":"Ref\AbstractReference":private]=>
+      NULL
+      ["notifier":"Ref\AbstractReference":private]=>
+      object(Closure)#5 (2) {
+        ["static"]=>
+        array(1) {
+          ["hash"]=>
+          string(4) "test"
+        }
+        ["this"]=>
+        *RECURSION*
+      }
+    }
+  }
+}
+object(Test)#1 (1) {
+  ["storage"]=>
+  array(0) {
+  }
+}

tests/004-SoftReference-clone.phpt

@@ -97,7 +97,7 @@ object(Ref\SoftReference)#5 (2) refcount(3){
 
 Soft references reported with cloned reference: ok
 
-Notified: object(Ref\SoftReference)#5 (2) refcount(6){
+Notified: object(Ref\SoftReference)#5 (2) refcount(7){
   ["referent":"Ref\AbstractReference":private]=>
   object(stdClass)#2 (0) refcount(2){
   }
@@ -116,7 +116,7 @@ Notified: object(Ref\SoftReference)#5 (2) refcount(6){
     }
   }
 }
-Notified: object(Ref\SoftReference)#4 (2) refcount(6){
+Notified: object(Ref\SoftReference)#4 (2) refcount(7){
   ["referent":"Ref\AbstractReference":private]=>
   object(stdClass)#2 (0) refcount(2){
   }