From 5e3518a5ec746d797323c13b6c312d66f9bdf130 Mon Sep 17 00:00:00 2001
From: CismonX <admin@cismon.net>
Date: Thu, 16 Aug 2018 13:03:56 +0800
Subject: [PATCH] fix bucket key segfault when converted into pair

---
 src/collections_methods.c   | 13 ++++++++-----
 tests/043-min-max-with.phpt |  2 +-
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/src/collections_methods.c b/src/collections_methods.c
index e15ec4d..d8dfc4a 100644
--- a/src/collections_methods.c
+++ b/src/collections_methods.c
@@ -56,16 +56,17 @@
 #define BUCKET_2_PAIR(pair, bucket)                                        \
     {                                                                      \
         zval _key;                                                         \
-        if (bucket->key)                                                   \
+        if ((bucket)->key)                                                 \
         {                                                                  \
-            ZVAL_STR(&_key, bucket->key);                                  \
+            GC_ADDREF((bucket)->key);                                      \
+            ZVAL_STR(&_key, (bucket)->key);                                \
         }                                                                  \
         else                                                               \
         {                                                                  \
-            ZVAL_LONG(&_key, bucket->h);                                   \
+            ZVAL_LONG(&_key, (bucket)->h);                                 \
         }                                                                  \
         PAIR_UPDATE_FIRST(pair, &_key);                                    \
-        PAIR_UPDATE_SECOND(pair, &bucket->val);                            \
+        PAIR_UPDATE_SECOND(pair, &(bucket)->val);                          \
     }
 
 #define CALLBACK_KEYVAL_INVOKE(params, bucket)                             \
@@ -179,7 +180,9 @@ static int bucket_compare_userland(const void* op1, const void* op2)
     ZVAL_COPY_VALUE(&params[0], &b1->val);
     ZVAL_COPY_VALUE(&params[1], &b2->val);
     zend_call_function(FCI_G, FCC_G);
-    return ZEND_NORMALIZE_BOOL(zval_get_long(&retval));
+    int result = ZEND_NORMALIZE_BOOL(zval_get_long(&retval));
+    zval_ptr_dtor(&retval);
+    return result;
 }
 
 int count_collection(zval* obj, zend_long* count)
diff --git a/tests/043-min-max-with.phpt b/tests/043-min-max-with.phpt
index 3f4c65a..c05bbaa 100644
--- a/tests/043-min-max-with.phpt
+++ b/tests/043-min-max-with.phpt
@@ -12,7 +12,7 @@ $by_b = function($p1, $p2) {
     return $p1->second['b'] - $p2->second['b'];
 };
 $by_c = function($p1, $p2) {
-    return $p1->second['c'] - $p2->second['c'];
+    return strval($p1->second['c'] - $p2->second['c']);
 };
 if ($collection->minWith($by_b) != $array['a'] || $collection->minWith($by_c) != $array['d'])
     echo 'Collection::minWith() failed.', PHP_EOL;