fix incdec - make value's refcount non-zero when passing to

write_property - otherwise __set caller cleanup could kill it.

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index fc77357f6b2bc10e0099d1f4b4634edd8126ce3e..195131ceda31dad4b4cfb95e85a40e9f3d9b7ce9 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1275,11 +1275,9 @@ static void zend_post_incdec_property(znode *result, znode *op1, znode *op2, tem
                *retval = *z;
                zendi_zval_copy_ctor(*retval);
                incdec_op(z);
+               z->refcount++;
                Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC);
-               if (z->refcount == 0) {
-                       zval_dtor(z);
-                       FREE_ZVAL(z);
-               }
+               zval_ptr_dtor(&z);
        }
        
        FREE_OP(Ts, op2, EG(free_op2));