Fixed bug #73350 (Exception::__toString() cause circular references)

NEWS

@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? ??? 2016 PHP 7.0.13
 
 - Core:
+  . Fixed bug #73350 (Exception::__toString() cause circular references).
+    (Laruence)
   . Fixed bug #73181 (parse_str() without a second argument leads to crash).
     (Nikita)
   . Fixed bug #66773 (Autoload with Opcache allows importing conflicting class

Zend/tests/bug73156.phpt

@@ -1,5 +1,5 @@
 --TEST--
-iBug #73156 (segfault on undefined function)
+Bug #73156 (segfault on undefined function)
 --FILE--
 <?php
 class A {

Zend/tests/bug73350.phpt

@@ -0,0 +1,27 @@
+--TEST--
+Bug #73350 (Exception::__toString() cause circular references)
+--FILE--
+<?php
+$e = new Exception();
+
+// This line cause problem :(
+// Comment it to see the difference.
+(string) $e;
+
+// This line show the clue (PHP Warning: ...).
+var_export($e);
+?>
+--EXPECTF--
+Exception::__set_state(array(
+   'message' => '',
+   'string' => 'Exception in %sbug73350.php:%d
+Stack trace:
+#0 {main}',
+   'code' => 0,
+   'file' => '%sbug73350.php',
+   'line' => %d,
+   'trace' => 
+  array (
+  ),
+   'previous' => NULL,
+))

Zend/zend_exceptions.c

@@ -776,14 +776,15 @@ ZEND_METHOD(exception, __toString)
 		Z_OBJPROP_P(exception)->u.v.nApplyCount++;
 		exception = GET_PROPERTY(exception, "previous");
 		if (exception && Z_TYPE_P(exception) == IS_OBJECT && Z_OBJPROP_P(exception)->u.v.nApplyCount > 0) {
-			exception = NULL;
+			break;
 		}
 	}
 	zval_dtor(&fname);
 
+	exception = getThis();
 	/* Reset apply counts */
 	while (exception && Z_TYPE_P(exception) == IS_OBJECT && (base_ce = i_get_exception_base(exception)) && instanceof_function(Z_OBJCE_P(exception), base_ce)) {
-		if(Z_OBJPROP_P(exception)->u.v.nApplyCount) {
+		if (Z_OBJPROP_P(exception)->u.v.nApplyCount) {
 			Z_OBJPROP_P(exception)->u.v.nApplyCount--;
 		} else {
 			break;