Fixed bug #50723 (Bug in garbage collector causes crash)

NEWS

@@ -39,6 +39,7 @@ PHP                                                                        NEWS
 - Fixed bug #50732 (exec() adds single byte twice to $output array). (Ilia)
 - Fixed bug #50728 (All PDOExceptions hardcode 'code' property to 0).
   (Joey, Ilia)
+- Fixed bug #50723 (Bug in garbage collector causes crash). (Dmitry)
 - Fixed bug #50690 (putenv does not set ENV when the value is only one char).
   (Pierre)
 - Fixed bug #50680 (strtotime() does not support eighth ordinal number). (Ilia)

Zend/zend_execute.h

@@ -228,7 +228,7 @@ static inline void *zend_vm_stack_alloc(size_t size TSRMLS_DC)
 		int extra = (ZEND_MM_ALIGNMENT - ((zend_uintptr_t)EG(argument_stack)->top & (ZEND_MM_ALIGNMENT - 1))) / sizeof(void*);
 
 		if (UNEXPECTED(size + extra + ZEND_MM_ALIGNED_SIZE(sizeof(void*)) / sizeof(void*) >
-		    (zend_uintptr_t)EG(argument_stack)->end - (zend_uintptr_t)EG(argument_stack)->top)) {
+		    (zend_uintptr_t)(EG(argument_stack)->end - EG(argument_stack)->top))) {
 			zend_vm_stack_extend(size TSRMLS_CC);
 		} else {
 			void **old_top = EG(argument_stack)->top;