- Fix refcounting

diff --git a/Zend/tests/closure_035.phpt b/Zend/tests/closure_035.phpt
new file mode 100755 (executable)
index 0000000..ebd1cdf
--- /dev/null
+++ b/Zend/tests/closure_035.phpt
@@ -0,0 +1,44 @@
+--TEST--
+Closure 035: Rebinding closure $this on property access
+--FILE--
+<?php
+
+$instance = 0;
+
+class Test {
+       function __construct() {
+               global $instance;
+               $this->instance = ++$instance;
+       }
+}
+
+$o = new Test;
+$o->func = function () {
+       var_dump($this);
+};
+$func = $o->func;
+$func();
+
+var_dump($instance);
+?>
+===DONE===
+--EXPECTF--
+object(Test)#%d (2) {
+  [u"instance"]=>
+  int(1)
+  [u"func"]=>
+  object(Closure)#%d (1) {
+    ["this"]=>
+    object(Test)#%d (2) {
+      [u"instance"]=>
+      int(1)
+      [u"func"]=>
+      object(Closure)#2 (1) {
+        ["this"]=>
+        *RECURSION*
+      }
+    }
+  }
+}
+int(1)
+===DONE===
\ No newline at end of file

diff --git a/Zend/zend_closures.c b/Zend/zend_closures.c
index 5aeb09667b148faae638139e676ce2d48e41f0ec..62d99c7e4c5cec2aa27cfe2d365c65ff21992780 100644 (file)
--- a/Zend/zend_closures.c
+++ b/Zend/zend_closures.c
@@ -128,7 +128,13 @@ ZEND_API zval* zend_closure_copy(zval *closure_obj, zval *this_ptr TSRMLS_DC) /*
 
        zval_copy_ctor(closure_obj);
        closure = (zend_closure *)zend_object_store_get_object(closure_obj TSRMLS_CC);
+       if (closure->this_ptr) {
+               zval_ptr_dtor(&closure->this_ptr);
+       }
        closure->this_ptr = this_ptr;
+       if (this_ptr) {
+               Z_ADDREF_P(this_ptr);
+       }
        return closure_obj;
 }
 /* }}} */