Fix

Author: danog

Zend/zend_alloc.c

@@ -174,10 +174,10 @@ static size_t _real_page_size = ZEND_MM_PAGE_SIZE;
 #ifdef __SANITIZE_ADDRESS__
 # include <sanitizer/asan_interface.h>
 
-#if 0
+#if 1
 
 #define ZEND_MM_POISON_DEBUG(_type, _ptr, _size) do { \
-	fprintf(stderr, "%s %p - %p in %d\n", (_type), (_ptr), ((size_t)_ptr)+((size_t)_size), __LINE__); \
+	fprintf(stderr, "%s %p - %p in %d\n", (_type), (_ptr), (void*) (((size_t)_ptr)+((size_t)_size)), __LINE__); \
 	fflush(stderr); \
 } while (0);
 
@@ -973,6 +973,8 @@ static void zend_mm_change_huge_block_size(zend_mm_heap *heap, void *ptr, size_t
 /* Large Runs */
 /**************/
 
+static size_t _zend_mm_gc(zend_mm_heap *heap);
+
 #if ZEND_DEBUG
 static void *zend_mm_alloc_pages(zend_mm_heap *heap, uint32_t pages_count, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 #else
@@ -1110,7 +1112,7 @@ static void *zend_mm_alloc_pages(zend_mm_heap *heap, uint32_t pages_count ZEND_F
 			} else {
 #if ZEND_MM_LIMIT
 				if (UNEXPECTED(ZEND_MM_CHUNK_SIZE > heap->limit - heap->real_size)) {
-					if (zend_mm_gc(heap)) {
+					if (_zend_mm_gc(heap)) {
 						goto get_chunk;
 					} else if (heap->overflow == 0) {
 #if ZEND_DEBUG
@@ -1127,7 +1129,7 @@ static void *zend_mm_alloc_pages(zend_mm_heap *heap, uint32_t pages_count ZEND_F
 				chunk = (zend_mm_chunk*)zend_mm_chunk_alloc(heap, ZEND_MM_CHUNK_SIZE, ZEND_MM_CHUNK_SIZE);
 				if (UNEXPECTED(chunk == NULL)) {
 					/* insufficient memory */
-					if (zend_mm_gc(heap) &&
+					if (_zend_mm_gc(heap) &&
 					    (chunk = (zend_mm_chunk*)zend_mm_chunk_alloc(heap, ZEND_MM_CHUNK_SIZE, ZEND_MM_CHUNK_SIZE)) != NULL) {
 						/* pass */
 					} else {
@@ -1772,7 +1774,7 @@ static zend_never_inline void *zend_mm_realloc_huge(zend_mm_heap *heap, void *pt
 		} else /* if (new_size > old_size) */ {
 #if ZEND_MM_LIMIT
 			if (UNEXPECTED(new_size - old_size > heap->limit - heap->real_size)) {
-				if (zend_mm_gc(heap) && new_size - old_size <= heap->limit - heap->real_size) {
+				if (_zend_mm_gc(heap) && new_size - old_size <= heap->limit - heap->real_size) {
 					/* pass */
 				} else if (heap->overflow == 0) {
 #if ZEND_DEBUG
@@ -2092,7 +2094,7 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
 
 #if ZEND_MM_LIMIT
 	if (UNEXPECTED(new_size > heap->limit - heap->real_size)) {
-		if (zend_mm_gc(heap) && new_size <= heap->limit - heap->real_size) {
+		if (_zend_mm_gc(heap) && new_size <= heap->limit - heap->real_size) {
 			/* pass */
 		} else if (heap->overflow == 0) {
 #if ZEND_DEBUG
@@ -2107,7 +2109,7 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
 	ptr = zend_mm_chunk_alloc(heap, new_size, ZEND_MM_CHUNK_SIZE);
 	if (UNEXPECTED(ptr == NULL)) {
 		/* insufficient memory */
-		if (zend_mm_gc(heap) &&
+		if (_zend_mm_gc(heap) &&
 		    (ptr = zend_mm_chunk_alloc(heap, new_size, ZEND_MM_CHUNK_SIZE)) != NULL) {
 			/* pass */
 		} else {
@@ -2231,7 +2233,7 @@ static zend_mm_heap *zend_mm_init(void)
 	return heap;
 }
 
-ZEND_API size_t zend_mm_gc(zend_mm_heap *heap)
+static size_t _zend_mm_gc(zend_mm_heap *heap)
 {
 	zend_mm_free_slot *p, *q;
 	zend_mm_chunk *chunk;
@@ -2242,7 +2244,6 @@ ZEND_API size_t zend_mm_gc(zend_mm_heap *heap)
 	bool has_free_pages;
 	size_t collected = 0;
 
-	ZEND_MM_UNPOISON_HEAP(heap);
 #if ZEND_MM_CUSTOM
 	if (heap->use_custom_heap) {
 		size_t (*gc)(void) = heap->custom_heap._gc;
@@ -2341,6 +2342,7 @@ ZEND_API size_t zend_mm_gc(zend_mm_heap *heap)
 					if (ZEND_MM_SRUN_FREE_COUNTER(info) == bin_elements[bin_num]) {
 						/* all elements are free */
 						zend_mm_free_pages_ex(heap, chunk, i, pages_count, 0);
+						ZEND_MM_UNPOISON_CHUNK_HDR(chunk);
 						collected += pages_count;
 					} else {
 						/* reset counter */
@@ -2368,11 +2370,18 @@ ZEND_API size_t zend_mm_gc(zend_mm_heap *heap)
 		}
 	} while (chunk != heap->main_chunk);
 	ZEND_MM_POISON_CHUNK_HDR(chunk, heap);
-	ZEND_MM_POISON_HEAP(heap);
 
 	return collected * ZEND_MM_PAGE_SIZE;
 }
 
+ZEND_API size_t zend_mm_gc(zend_mm_heap *heap)
+{
+	ZEND_MM_UNPOISON_HEAP(heap);
+	size_t ret = _zend_mm_gc(heap);
+	ZEND_MM_POISON_HEAP(heap);
+	return ret;
+}
+
 #if ZEND_DEBUG
 /******************/
 /* Leak detection */
@@ -3428,7 +3437,7 @@ static size_t poison_gc(void)
 	zend_mm_get_custom_handlers_ex(heap, &_malloc, &_free, &_realloc, &_gc, &_shutdown);
 	zend_mm_set_custom_handlers_ex(heap, NULL, NULL, NULL, NULL, NULL);
 
-	size_t collected = zend_mm_gc(heap);
+	size_t collected = _zend_mm_gc(heap);
 
 	zend_mm_set_custom_handlers_ex(heap, _malloc, _free, _realloc, _gc, _shutdown);