Fixed variations of bug #35163

diff --git a/Zend/tests/bug35163_2.phpt b/Zend/tests/bug35163_2.phpt
new file mode 100755 (executable)
index 0000000..4adf770
--- /dev/null
+++ b/Zend/tests/bug35163_2.phpt
@@ -0,0 +1,65 @@
+--TEST--
+Bug #35163.2 (Array elements can lose references)
+--FILE--
+<?php
+$a = array(1);
+$b = 'a';
+${$b}[] =& $$b;
+${$b}[] =& $$b;
+${$b}[0] = 2;
+var_dump($a);
+$a[0] = null;
+$a = null;
+?>
+--EXPECT--
+array(3) {
+  [0]=>
+  int(2)
+  [1]=>
+  &array(3) {
+    [0]=>
+    int(2)
+    [1]=>
+    &array(3) {
+      [0]=>
+      int(2)
+      [1]=>
+      *RECURSION*
+      [2]=>
+      *RECURSION*
+    }
+    [2]=>
+    &array(3) {
+      [0]=>
+      int(2)
+      [1]=>
+      *RECURSION*
+      [2]=>
+      *RECURSION*
+    }
+  }
+  [2]=>
+  &array(3) {
+    [0]=>
+    int(2)
+    [1]=>
+    &array(3) {
+      [0]=>
+      int(2)
+      [1]=>
+      *RECURSION*
+      [2]=>
+      *RECURSION*
+    }
+    [2]=>
+    &array(3) {
+      [0]=>
+      int(2)
+      [1]=>
+      *RECURSION*
+      [2]=>
+      *RECURSION*
+    }
+  }
+}
+

diff --git a/Zend/tests/bug35163_3.phpt b/Zend/tests/bug35163_3.phpt
new file mode 100755 (executable)
index 0000000..d2b3c25
--- /dev/null
+++ b/Zend/tests/bug35163_3.phpt
@@ -0,0 +1,39 @@
+--TEST--
+Bug #35163.3 (Array elements can lose references)
+--FILE--
+<?php
+$a = new stdClass;
+$a->b = array(1);
+$a->b[] =& $a->b;
+$a->b[] =& $a->b;
+$a->b[0] = 2;
+var_dump($a);
+$a->b = null;
+$a = null;
+?>
+--EXPECT--
+object(stdClass)#1 (1) {
+  ["b"]=>
+  &array(3) {
+    [0]=>
+    int(2)
+    [1]=>
+    &array(3) {
+      [0]=>
+      int(2)
+      [1]=>
+      *RECURSION*
+      [2]=>
+      *RECURSION*
+    }
+    [2]=>
+    &array(3) {
+      [0]=>
+      int(2)
+      [1]=>
+      *RECURSION*
+      [2]=>
+      *RECURSION*
+    }
+  }
+}

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index e2a3621d1392b34508324d32d0583b9082f8df85..291fce27b4e647b53b0947c21015722618175bca 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -927,8 +927,8 @@ void zend_do_end_variable_parse(int type, int arg_offset TSRMLS_DC)
                        if (le == NULL) break;
                        opline_ptr = (zend_op *)le->data;
                }
-               if (opline->opcode == ZEND_FETCH_DIM_W) {
-                       opline->extended_value = arg_offset;
+               if (type == BP_VAR_W && arg_offset) {
+                       opline->extended_value = ZEND_FETCH_MAKE_REF;
                }
        }
        zend_llist_destroy(fetch_list_ptr);

diff --git a/Zend/zend_compile.h b/Zend/zend_compile.h
index af89f111fa0375b09f0a4ca1ad1384352e8a3ec1..95109b0a2eab3354480cd9b1d3580f24d1856b6b 100644 (file)
--- a/Zend/zend_compile.h
+++ b/Zend/zend_compile.h
@@ -655,7 +655,8 @@ int zendlex(znode *zendlval TSRMLS_DC);
 #define ZEND_HANDLE_STREAM                     5
 
 #define ZEND_FETCH_STANDARD            0
-#define ZEND_FETCH_ADD_LOCK            1
+#define ZEND_FETCH_ADD_LOCK            (1<<0)
+#define ZEND_FETCH_MAKE_REF            (1<<1)
 
 #define ZEND_FE_FETCH_BYREF    1
 #define ZEND_FE_FETCH_WITH_KEY 2

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 7e1a41bbb66d2e53d77adf4612f0b45651c331f7..599fe270442ab822d819b97097b64ea7badf3300 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -981,6 +981,9 @@ ZEND_VM_HELPER_EX(zend_fetch_var_address_helper, CONST|TMP|VAR|CV, ANY, int type
                zval_dtor(varname);
        }
        if (!RETURN_VALUE_UNUSED(&opline->result)) {
+               if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+                       SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
+               }
                EX_T(opline->result.u.var).var.ptr_ptr = retval;
                PZVAL_LOCK(*retval);
                switch (type) {
@@ -1068,7 +1071,7 @@ ZEND_VM_HANDLER(84, ZEND_FETCH_DIM_W, VAR|CV, CONST|TMP|VAR|UNUSED|CV)
        FREE_OP1_VAR_PTR();
 
        /* We are going to assign the result by reference */
-       if (opline->extended_value) {           
+       if (opline->extended_value) {
                Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
                SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr);
                Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
@@ -1239,7 +1242,7 @@ ZEND_VM_HANDLER(85, ZEND_FETCH_OBJ_W, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
        zend_free_op free_op1, free_op2;
        zval *property = GET_OP2_ZVAL_PTR(BP_VAR_R);
 
-       if (opline->extended_value == ZEND_FETCH_ADD_LOCK && OP1_TYPE != IS_CV) {
+       if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && OP1_TYPE != IS_CV) {
                PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr);
                EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr;
        }
@@ -1259,6 +1262,14 @@ ZEND_VM_HANDLER(85, ZEND_FETCH_OBJ_W, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
                AI_USE_PTR(EX_T(opline->result.u.var).var);
        }
        FREE_OP1_VAR_PTR();
+
+       /* We are going to assign the result by reference */
+       if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+               Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+               SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr);
+               Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+       }
+       
        ZEND_VM_NEXT_OPCODE();
 }
 

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 7a9a99fcdfa4d67e4a9f3e43d41be4fd1a23b7ee..d4f9a2623b687470718d59deb67013ff881a707c 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -1280,6 +1280,9 @@ static int zend_fetch_var_address_helper_SPEC_CONST(int type, ZEND_OPCODE_HANDLE
                zval_dtor(varname);
        }
        if (!RETURN_VALUE_UNUSED(&opline->result)) {
+               if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+                       SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
+               }
                EX_T(opline->result.u.var).var.ptr_ptr = retval;
                PZVAL_LOCK(*retval);
                switch (type) {
@@ -4354,6 +4357,9 @@ static int zend_fetch_var_address_helper_SPEC_TMP(int type, ZEND_OPCODE_HANDLER_
                zval_dtor(varname);
        }
        if (!RETURN_VALUE_UNUSED(&opline->result)) {
+               if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+                       SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
+               }
                EX_T(opline->result.u.var).var.ptr_ptr = retval;
                PZVAL_LOCK(*retval);
                switch (type) {
@@ -7410,6 +7416,9 @@ static int zend_fetch_var_address_helper_SPEC_VAR(int type, ZEND_OPCODE_HANDLER_
                zval_dtor(varname);
        }
        if (!RETURN_VALUE_UNUSED(&opline->result)) {
+               if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+                       SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
+               }
                EX_T(opline->result.u.var).var.ptr_ptr = retval;
                PZVAL_LOCK(*retval);
                switch (type) {
@@ -9392,7 +9401,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zend_free_op free_op1;
        zval *property = &opline->op2.u.constant;
 
-       if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_VAR != IS_CV) {
+       if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_VAR != IS_CV) {
                PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr);
                EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr;
        }
@@ -9412,6 +9421,14 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                AI_USE_PTR(EX_T(opline->result.u.var).var);
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+
+       /* We are going to assign the result by reference */
+       if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+               Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+               SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr);
+               Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+       }
+
        ZEND_VM_NEXT_OPCODE();
 }
 
@@ -11043,7 +11060,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zend_free_op free_op1, free_op2;
        zval *property = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC);
 
-       if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_VAR != IS_CV) {
+       if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_VAR != IS_CV) {
                PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr);
                EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr;
        }
@@ -11063,6 +11080,14 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                AI_USE_PTR(EX_T(opline->result.u.var).var);
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+
+       /* We are going to assign the result by reference */
+       if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+               Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+               SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr);
+               Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+       }
+
        ZEND_VM_NEXT_OPCODE();
 }
 
@@ -12630,7 +12655,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zend_free_op free_op1, free_op2;
        zval *property = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC);
 
-       if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_VAR != IS_CV) {
+       if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_VAR != IS_CV) {
                PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr);
                EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr;
        }
@@ -12650,6 +12675,14 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                AI_USE_PTR(EX_T(opline->result.u.var).var);
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+
+       /* We are going to assign the result by reference */
+       if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+               Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+               SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr);
+               Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+       }
+
        ZEND_VM_NEXT_OPCODE();
 }
 
@@ -14786,7 +14819,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zend_free_op free_op1;
        zval *property = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC);
 
-       if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_VAR != IS_CV) {
+       if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_VAR != IS_CV) {
                PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr);
                EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr;
        }
@@ -14806,6 +14839,14 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                AI_USE_PTR(EX_T(opline->result.u.var).var);
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+
+       /* We are going to assign the result by reference */
+       if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+               Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+               SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr);
+               Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+       }
+
        ZEND_VM_NEXT_OPCODE();
 }
 
@@ -16117,7 +16158,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zend_free_op free_op1;
        zval *property = &opline->op2.u.constant;
 
-       if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_UNUSED != IS_CV) {
+       if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_UNUSED != IS_CV) {
                PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr);
                EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr;
        }
@@ -16137,6 +16178,13 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                AI_USE_PTR(EX_T(opline->result.u.var).var);
        }
 
+       /* We are going to assign the result by reference */
+       if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+               Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+               SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr);
+               Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+       }
+
        ZEND_VM_NEXT_OPCODE();
 }
 
@@ -17149,7 +17197,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zend_free_op free_op1, free_op2;
        zval *property = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC);
 
-       if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_UNUSED != IS_CV) {
+       if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_UNUSED != IS_CV) {
                PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr);
                EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr;
        }
@@ -17169,6 +17217,13 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                AI_USE_PTR(EX_T(opline->result.u.var).var);
        }
 
+       /* We are going to assign the result by reference */
+       if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+               Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+               SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr);
+               Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+       }
+
        ZEND_VM_NEXT_OPCODE();
 }
 
@@ -18115,7 +18170,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zend_free_op free_op1, free_op2;
        zval *property = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC);
 
-       if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_UNUSED != IS_CV) {
+       if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_UNUSED != IS_CV) {
                PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr);
                EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr;
        }
@@ -18135,6 +18190,13 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                AI_USE_PTR(EX_T(opline->result.u.var).var);
        }
 
+       /* We are going to assign the result by reference */
+       if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+               Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+               SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr);
+               Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+       }
+
        ZEND_VM_NEXT_OPCODE();
 }
 
@@ -19346,7 +19408,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zend_free_op free_op1;
        zval *property = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC);
 
-       if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_UNUSED != IS_CV) {
+       if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_UNUSED != IS_CV) {
                PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr);
                EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr;
        }
@@ -19366,6 +19428,13 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                AI_USE_PTR(EX_T(opline->result.u.var).var);
        }
 
+       /* We are going to assign the result by reference */
+       if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+               Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+               SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr);
+               Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+       }
+
        ZEND_VM_NEXT_OPCODE();
 }
 
@@ -20085,6 +20154,9 @@ static int zend_fetch_var_address_helper_SPEC_CV(int type, ZEND_OPCODE_HANDLER_A
                zval_dtor(varname);
        }
        if (!RETURN_VALUE_UNUSED(&opline->result)) {
+               if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+                       SEPARATE_ZVAL_TO_MAKE_IS_REF(retval);
+               }
                EX_T(opline->result.u.var).var.ptr_ptr = retval;
                PZVAL_LOCK(*retval);
                switch (type) {
@@ -21903,7 +21975,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zend_free_op free_op1;
        zval *property = &opline->op2.u.constant;
 
-       if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_CV != IS_CV) {
+       if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_CV != IS_CV) {
                PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr);
                EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr;
        }
@@ -21923,6 +21995,13 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                AI_USE_PTR(EX_T(opline->result.u.var).var);
        }
 
+       /* We are going to assign the result by reference */
+       if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+               Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+               SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr);
+               Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+       }
+
        ZEND_VM_NEXT_OPCODE();
 }
 
@@ -23389,7 +23468,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zend_free_op free_op1, free_op2;
        zval *property = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC);
 
-       if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_CV != IS_CV) {
+       if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_CV != IS_CV) {
                PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr);
                EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr;
        }
@@ -23409,6 +23488,13 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                AI_USE_PTR(EX_T(opline->result.u.var).var);
        }
 
+       /* We are going to assign the result by reference */
+       if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+               Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+               SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr);
+               Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+       }
+
        ZEND_VM_NEXT_OPCODE();
 }
 
@@ -24878,7 +24964,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zend_free_op free_op1, free_op2;
        zval *property = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC);
 
-       if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_CV != IS_CV) {
+       if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_CV != IS_CV) {
                PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr);
                EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr;
        }
@@ -24898,6 +24984,13 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                AI_USE_PTR(EX_T(opline->result.u.var).var);
        }
 
+       /* We are going to assign the result by reference */
+       if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+               Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+               SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr);
+               Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+       }
+
        ZEND_VM_NEXT_OPCODE();
 }
 
@@ -26844,7 +26937,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zend_free_op free_op1;
        zval *property = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC);
 
-       if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_CV != IS_CV) {
+       if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_CV != IS_CV) {
                PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr);
                EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr;
        }
@@ -26864,6 +26957,13 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                AI_USE_PTR(EX_T(opline->result.u.var).var);
        }
 
+       /* We are going to assign the result by reference */
+       if (opline->extended_value & ZEND_FETCH_MAKE_REF) {
+               Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+               SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr);
+               Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr);
+       }
+
        ZEND_VM_NEXT_OPCODE();
 }