Fix bug #1812

diff --git a/Zend/zend-parser.y b/Zend/zend-parser.y
index f0c853d2af98aab9123911b21241575343d1be17..56263f4847fb83f1605a82692d9c0167e1ff4754 100644 (file)
--- a/Zend/zend-parser.y
+++ b/Zend/zend-parser.y
@@ -161,11 +161,11 @@ statement:
        |       T_FOR 
                        '('
                                for_expr
-                       ';' { do_free(&$3 CLS_CC); $4.u.opline_num = get_next_op_number(CG(active_op_array)); }
+                       ';' { do_free(&$3, 0 CLS_CC); $4.u.opline_num = get_next_op_number(CG(active_op_array)); }
                                for_expr
                        ';' { do_for_cond(&$6, &$7 CLS_CC); }
                                for_expr
-                       ')' { do_free(&$9 CLS_CC); do_for_before_statement(&$4, &$7 CLS_CC); }
+                       ')' { do_free(&$9, 0 CLS_CC); do_for_before_statement(&$4, &$7 CLS_CC); }
                        for_statement { do_for_end(&$7 CLS_CC); }
        |       T_SWITCH '(' expr ')' { do_switch_cond(&$3 CLS_CC); } switch_case_list { do_switch_end(&$6 CLS_CC); }
        |       T_BREAK ';'                     { do_brk_cont(ZEND_BRK, NULL CLS_CC); }
@@ -178,7 +178,7 @@ statement:
        |       T_STATIC static_var_list
        |       T_ECHO echo_expr_list ';'
        |       T_INLINE_HTML                   { do_echo(&$1 CLS_CC); }
-       |       expr ';'                        { do_free(&$1 CLS_CC); }
+       |       expr ';'                        { do_free(&$1, 0 CLS_CC); }
        |       T_REQUIRE expr ';'                      { if ($2.op_type==IS_CONST && $2.u.constant.type==IS_STRING) { require_filename($2.u.constant.value.str.val CLS_CC); zval_dtor(&$2.u.constant); } else { do_include_or_eval(ZEND_INCLUDE, &$$, &$2 CLS_CC); } }
        |       T_UNSET '(' r_cvar ')' ';' { do_unset(&$3 CLS_CC); }
        |       T_FOREACH '(' expr T_AS { do_foreach_begin(&$1, &$3, &$2, &$4 CLS_CC); } w_cvar foreach_optional_arg ')' { do_foreach_cont(&$6, &$7, &$4 CLS_CC); } foreach_statement { do_foreach_end(&$1, &$2 CLS_CC); }
@@ -358,7 +358,7 @@ echo_expr_list:
 
 for_expr:
                /* empty */                     { $$.op_type = IS_CONST;  $$.u.constant.type = IS_BOOL;  $$.u.constant.value.lval = 1; }
-       |       for_expr ',' { do_free(&$1 CLS_CC); } expr      { $$ = $4; }
+       |       for_expr ',' { do_free(&$1, 0 CLS_CC); } expr   { $$ = $4; }
        |       expr                            { $$ = $1; }
 ;
 

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 5a224a8b7edbe64dc2a943f38f60ecb33aa73ed3..277cebe3c6f1d10f55740b949894f39bee5ae5a4 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -573,7 +573,7 @@ void do_add_variable(znode *result, znode *op1, znode *op2 CLS_DC)
 }
 
        
-void do_free(znode *op1 CLS_DC)
+void do_free(znode *op1, int is_used CLS_DC)
 {
        if (op1->op_type==IS_TMP_VAR) {
                zend_op *opline = get_next_op(CG(active_op_array) CLS_CC);
@@ -581,14 +581,13 @@ void do_free(znode *op1 CLS_DC)
                opline->opcode = ZEND_FREE;
                opline->op1 = *op1;
                SET_UNUSED(opline->op2);
-       } else if (op1->op_type==IS_VAR) {
+       } else if (!is_used && op1->op_type==IS_VAR) {
                zend_op *opline = &CG(active_op_array)->opcodes[CG(active_op_array)->last-1];
 
                if (opline->result.op_type == op1->op_type
                        && opline->result.u.var == op1->u.var) {
                        opline->result.u.EA.type |= EXT_TYPE_UNUSED;
                } else {
-
                        /* This should be an object instanciation
                         * Find JMP_NO_CTOR, mark the preceding ASSIGN and the
                         * proceeding INIT_FCALL_BY_NAME as unused
@@ -1096,7 +1095,7 @@ void do_switch_end(znode *case_list CLS_DC)
        CG(active_op_array)->current_brk_cont = CG(active_op_array)->brk_cont_array[CG(active_op_array)->current_brk_cont].parent;
 
        /* emit free for the switch condition*/
-       do_free(&switch_entry_ptr->cond CLS_CC);
+       do_free(&switch_entry_ptr->cond, 1 CLS_CC);
        if (switch_entry_ptr->cond.op_type == IS_CONST) {
                zval_dtor(&switch_entry_ptr->cond.u.constant);
        }
@@ -1371,7 +1370,7 @@ void do_end_new_object(znode *class_name, znode *new_token, znode *argument_list
                zval_copy_ctor(&class_name->u.constant);
        }
        do_end_function_call(class_name, &ctor_result, argument_list, 1 CLS_CC);
-       do_free(&ctor_result CLS_CC);
+       do_free(&ctor_result, 0 CLS_CC);
 
        CG(active_op_array)->opcodes[new_token->u.opline_num].op2.u.opline_num = get_next_op_number(CG(active_op_array));
 }
@@ -1768,7 +1767,7 @@ void do_foreach_cont(znode *value, znode *key, znode *as_token CLS_DC)
                do_assign(&dummy, key, &result_key CLS_CC);
                CG(active_op_array)->opcodes[CG(active_op_array)->last-1].result.u.EA.type |= EXT_TYPE_UNUSED;  
        }
-       do_free(as_token CLS_CC);
+       do_free(as_token, 0 CLS_CC);
 
        do_begin_loop(CLS_C);
        INC_BPC(CG(active_op_array));
@@ -1787,7 +1786,7 @@ void do_foreach_end(znode *foreach_token, znode *open_brackets_token CLS_DC)
 
        do_end_loop(foreach_token->u.opline_num CLS_CC);
 
-       do_free(open_brackets_token CLS_CC);
+       do_free(open_brackets_token, 0 CLS_CC);
 
        DEC_BPC(CG(active_op_array));
 }

diff --git a/Zend/zend_compile.h b/Zend/zend_compile.h
index b1ad05ca1b0eb1b507fa487d18c345aa42d64b7e..ff64d18d2606cf7c41a3234f6b5ebb2883afbbf9 100644 (file)
--- a/Zend/zend_compile.h
+++ b/Zend/zend_compile.h
@@ -250,7 +250,7 @@ void do_post_incdec(znode *result, znode *op1, int op CLS_DC);
 void do_begin_variable_parse(CLS_D);
 void do_end_variable_parse(int type CLS_DC);
 
-void do_free(znode *op1 CLS_DC);
+void do_free(znode *op1, int is_used CLS_DC);
 
 void do_init_string(znode *result CLS_DC);
 void do_add_char(znode *result, znode *op1, znode *op2 CLS_DC);

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index ca8a7303bc714f2dc512857540c72db5c7ca2c34..eacac2bb342f9ea50c3de6e9844edd6bafafc42e 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1592,14 +1592,29 @@ send_by_ref:
                                        continue;
                                }
                                break;
-                       case ZEND_CASE:
-                               if (opline->op1.op_type == IS_VAR) {
-                                       PZVAL_LOCK(*Ts[opline->op1.u.var].var);
+                       case ZEND_CASE: {
+                                       int switch_expr_is_overloaded=0;
+
+                                       if (opline->op1.op_type==IS_VAR) {
+                                               if (Ts[opline->op1.u.var].var) {
+                                                       PZVAL_LOCK(*Ts[opline->op1.u.var].var);
+                                               } else {
+                                                       switch_expr_is_overloaded = 1;
+                                                       if (Ts[opline->op1.u.var].EA.type==IS_STRING_OFFSET) {
+                                                               Ts[opline->op1.u.var].EA.str->refcount++;
+                                                       }
+                                               }
+                                       }
+                                       is_equal_function(&Ts[opline->result.u.var].tmp_var, 
+                                                                get_zval_ptr(&opline->op1, Ts, &free_op1, BP_VAR_R),
+                                                                get_zval_ptr(&opline->op2, Ts, &free_op2, BP_VAR_R));
+
+                                       FREE_OP(&opline->op1, free_op1);
+                                       FREE_OP(&opline->op2, free_op2);
+                                       if (switch_expr_is_overloaded) {
+                                               Ts[opline->op1.u.var].var = NULL;
+                                       }
                                }
-                               is_equal_function(&Ts[opline->result.u.var].tmp_var, 
-                                                        get_zval_ptr(&opline->op1, Ts, &free_op1, BP_VAR_R),
-                                                        get_zval_ptr(&opline->op2, Ts, &free_op2, BP_VAR_R) );
-                               FREE_OP(&opline->op2, free_op2);
                                break;
                        case ZEND_NEW: {
                                        zval *tmp = get_zval_ptr(&opline->op1, Ts, &free_op1, BP_VAR_R);

diff --git a/Zend/zend_execute.h b/Zend/zend_execute.h
index b955b0deae1c4f8fedafa16c0b9b720292a0c00a..688e4614109a496bebe071ca972eac5f56f2c72d 100644 (file)
--- a/Zend/zend_execute.h
+++ b/Zend/zend_execute.h
@@ -28,7 +28,7 @@ typedef union _temp_variable {
        zval tmp_var;
        zval **var;
        struct {
-               zval **var_dummy; /* a dummy */
+               zval tmp_var; /* a dummy */
 
                zval *str;
                int offset;