From 1f6b842af430b8cbba0fb1c38a2796ab399171c3 Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@gmail.com>
Date: Thu, 28 Jun 2018 12:37:33 +0800
Subject: Fixed bug #76536 (PHP crashes with core dump when throwing exception
 in error handler). (Laruence)

---
 NEWS                               |  4 ++++
 ext/reflection/php_reflection.c    |  2 +-
 ext/reflection/tests/bug76536.phpt | 20 ++++++++++++++++++++
 3 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 ext/reflection/tests/bug76536.phpt

diff --git a/NEWS b/NEWS
index d5840d2d25..86fc1106bc 100644
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,10 @@ PHP                                                                        NEWS
 - phpdbg:
   . Fix arginfo wrt. optional/required parameters. (cmb)
 
+- Reflection:
+  . Fixed bug #76536 (PHP crashes with core dump when throwing exception in
+    error handler). (Laruence)
+
 - Standard:
   . Fixed bug #76505 (array_merge_recursive() is duplicating sub-array keys).
     (Laruence)
diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index 7c6e20c07e..95b86e7283 100644
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -4617,7 +4617,7 @@ ZEND_METHOD(reflection_class, getConstants)
 	ZEND_HASH_FOREACH_STR_KEY_PTR(&ce->constants_table, key, c) {
 		if (UNEXPECTED(zval_update_constant_ex(&c->value, ce) != SUCCESS)) {
 			zend_array_destroy(Z_ARRVAL_P(return_value));
-			return;
+			RETURN_NULL();
 		}
 		val = zend_hash_add_new(Z_ARRVAL_P(return_value), key, &c->value);
 		Z_TRY_ADDREF_P(val);
diff --git a/ext/reflection/tests/bug76536.phpt b/ext/reflection/tests/bug76536.phpt
new file mode 100644
index 0000000000..9f3b3fdb31
--- /dev/null
+++ b/ext/reflection/tests/bug76536.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #76536 (PHP crashes with core dump when throwing exception in error handler)
+--FILE--
+<?php
+class SomeConstants {const SOME_CONSTANT = SOME_NONSENSE;}
+
+function handleError() {throw new ErrorException();}
+
+set_error_handler('handleError');
+set_exception_handler('handleError');
+
+$r = new \ReflectionClass(SomeConstants::class);
+$r->getConstants();
+?>
+--EXPECTF--
+Fatal error: Uncaught ErrorException in %sbug76536.php:%d
+Stack trace:
+#0 [internal function]: handleError(Object(ErrorException))
+#1 {main}
+  thrown in %sbug76536.php on line %d
-- 
cgit v1.2.1