Fixed bug #47343 (gc_collect_cycles causes a segfault when called within a destructor in one case)

NEWS

@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? ??? 2009, PHP 5.3.0 Beta 2  
 - Fixed bug #47398 (PDO_Firebird doesn't implements quoter correctly). (Felipe)
 - Fixed bug #47390 (odbc_fetch_into - BC in php 5.3.0). (Felipe)
+- Fixed bug #47343 (gc_collect_cycles causes a segfault when called within a
+  destructor in one case). (Dmitry)
 - Fixed bug #47329 (Crash in garbage collector). (Dmitry)
 - Fixed bug #47320 ($php_errormsg out of scope in functions). (Dmitry)
 - Fixed bug #47265 (generating phar.phar failes because of safe_mode). (Greg)

Zend/tests/bug47343.phpt

@@ -0,0 +1,44 @@
+--TEST--
+Bug #47343 (gc_collect_cycles causes a segfault when called within a destructor in one case)
+--FILE--
+<?php
+class A
+{
+	public function __destruct()
+	{
+		gc_collect_cycles();
+	}
+	
+	public function getB()
+	{
+		$this->data['foo'] = new B($this);
+		$this->data['bar'] = new B($this);
+		// Return either of the above
+		return $this->data['foo'];
+	}
+}
+
+class B
+{
+	public function B($A)
+	{
+		$this->A = $A;
+	}
+
+	public function __destruct()
+	{
+	}
+}
+
+for ($i = 0; $i < 2; $i++)
+{
+	$Aobj = new A;
+	$Bobj = $Aobj->getB();
+	unset($Bobj);
+	unset($Aobj);
+}
+
+echo "DONE\n";
+?>
+--EXPECT--
+DONE

Zend/zend_gc.c

@@ -521,7 +521,7 @@ static void gc_collect_roots(TSRMLS_D)
 	}
 }
 
-#define FREE_LIST_END ((zval_gc_info*)((-1)|~GC_COLOR))
+#define FREE_LIST_END ((zval_gc_info*)(~(zend_uintptr_t)GC_COLOR))
 
 ZEND_API int gc_collect_cycles(TSRMLS_D)
 {