Fixed bug #71914 (Reference is lost in "switch")

diff --git a/NEWS b/NEWS
index 6482d386491fbdcd9762cda53f058bd8f15d9294..fcf3fe3ee2cfd9ea98c48f4c5405331ac6bae746 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,7 @@ PHP                                                                        NEWS
 ?? ??? 2016 PHP 7.0.6
 
 - Core:
+  . Fixed bug #71914 (Reference is lost in "switch"). (Laruence)
   . Fixed Bug #71859 (zend_objects_store_call_destructors operates on realloced
     memory, crashing). (Laruence)
   . Fixed bug #71841 (EG(error_zval) is not handled well). (Laruence)

diff --git a/Zend/tests/bug71914.phpt b/Zend/tests/bug71914.phpt
new file mode 100644 (file)
index 0000000..8f825f8
--- /dev/null
+++ b/Zend/tests/bug71914.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Bug #71914 (Reference is lost in "switch")
+--FILE--
+<?php
+
+function bug(&$value) {
+       switch ($value) {
+       case "xxxx":
+               $value = true;
+               break;
+       }
+}
+
+
+function test($arr, &$dummy) {
+       bug($arr["str"]);
+       var_dump($arr["str"]);
+}
+
+
+$array = array("str" => "xxxx");
+test($array, $array["str"]);
+?>
+--EXPECT--
+bool(true)

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 2c721c398a16f5cb220b57b1c32a3a87c317ec92..8e658f5d8891edeecd4cd5d9d838644b7431352d 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -4903,7 +4903,7 @@ ZEND_VM_HANDLER(48, ZEND_CASE, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
        SAVE_OPLINE();
        if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_P(op1) == IS_UNDEF)) {
                op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
-       } else if ((OP1_TYPE & (IS_VAR|IS_CV)) && UNEXPECTED(Z_ISREF_P(op1))) {
+       } else if ((OP1_TYPE & IS_VAR) && UNEXPECTED(Z_ISREF_P(op1))) {
                /* Don't keep lock on reference, lock the value instead */
                if (UNEXPECTED(Z_REFCOUNT_P(op1) == 1)) {
                        ZVAL_UNREF(op1);

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index c719aa280854a8c2b214d7b18c52ed8f7b5d3fd2..bdc1bd7df4de3cb5442b701589b9d3eeeb6759b3 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -5858,7 +5858,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CASE_SPEC_CONST_CONST_HANDLER(
        SAVE_OPLINE();
        if (IS_CONST == IS_CV && UNEXPECTED(Z_TYPE_P(op1) == IS_UNDEF)) {
                op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
-       } else if ((IS_CONST & (IS_VAR|IS_CV)) && UNEXPECTED(Z_ISREF_P(op1))) {
+       } else if ((IS_CONST & IS_VAR) && UNEXPECTED(Z_ISREF_P(op1))) {
                /* Don't keep lock on reference, lock the value instead */
                if (UNEXPECTED(Z_REFCOUNT_P(op1) == 1)) {
                        ZVAL_UNREF(op1);
@@ -9654,7 +9654,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CASE_SPEC_CONST_CV_HANDLER(ZEN
        SAVE_OPLINE();
        if (IS_CONST == IS_CV && UNEXPECTED(Z_TYPE_P(op1) == IS_UNDEF)) {
                op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
-       } else if ((IS_CONST & (IS_VAR|IS_CV)) && UNEXPECTED(Z_ISREF_P(op1))) {
+       } else if ((IS_CONST & IS_VAR) && UNEXPECTED(Z_ISREF_P(op1))) {
                /* Don't keep lock on reference, lock the value instead */
                if (UNEXPECTED(Z_REFCOUNT_P(op1) == 1)) {
                        ZVAL_UNREF(op1);
@@ -11428,7 +11428,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CASE_SPEC_CONST_TMPVAR_HANDLER
        SAVE_OPLINE();
        if (IS_CONST == IS_CV && UNEXPECTED(Z_TYPE_P(op1) == IS_UNDEF)) {
                op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
-       } else if ((IS_CONST & (IS_VAR|IS_CV)) && UNEXPECTED(Z_ISREF_P(op1))) {
+       } else if ((IS_CONST & IS_VAR) && UNEXPECTED(Z_ISREF_P(op1))) {
                /* Don't keep lock on reference, lock the value instead */
                if (UNEXPECTED(Z_REFCOUNT_P(op1) == 1)) {
                        ZVAL_UNREF(op1);
@@ -32184,7 +32184,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CASE_SPEC_CV_CONST_HANDLER(ZEN
        SAVE_OPLINE();
        if (IS_CV == IS_CV && UNEXPECTED(Z_TYPE_P(op1) == IS_UNDEF)) {
                op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
-       } else if ((IS_CV & (IS_VAR|IS_CV)) && UNEXPECTED(Z_ISREF_P(op1))) {
+       } else if ((IS_CV & IS_VAR) && UNEXPECTED(Z_ISREF_P(op1))) {
                /* Don't keep lock on reference, lock the value instead */
                if (UNEXPECTED(Z_REFCOUNT_P(op1) == 1)) {
                        ZVAL_UNREF(op1);
@@ -37280,7 +37280,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CASE_SPEC_CV_CV_HANDLER(ZEND_O
        SAVE_OPLINE();
        if (IS_CV == IS_CV && UNEXPECTED(Z_TYPE_P(op1) == IS_UNDEF)) {
                op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
-       } else if ((IS_CV & (IS_VAR|IS_CV)) && UNEXPECTED(Z_ISREF_P(op1))) {
+       } else if ((IS_CV & IS_VAR) && UNEXPECTED(Z_ISREF_P(op1))) {
                /* Don't keep lock on reference, lock the value instead */
                if (UNEXPECTED(Z_REFCOUNT_P(op1) == 1)) {
                        ZVAL_UNREF(op1);
@@ -39873,7 +39873,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CASE_SPEC_CV_TMPVAR_HANDLER(ZE
        SAVE_OPLINE();
        if (IS_CV == IS_CV && UNEXPECTED(Z_TYPE_P(op1) == IS_UNDEF)) {
                op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
-       } else if ((IS_CV & (IS_VAR|IS_CV)) && UNEXPECTED(Z_ISREF_P(op1))) {
+       } else if ((IS_CV & IS_VAR) && UNEXPECTED(Z_ISREF_P(op1))) {
                /* Don't keep lock on reference, lock the value instead */
                if (UNEXPECTED(Z_REFCOUNT_P(op1) == 1)) {
                        ZVAL_UNREF(op1);
@@ -42108,7 +42108,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CASE_SPEC_TMPVAR_CONST_HANDLER
        SAVE_OPLINE();
        if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_TYPE_P(op1) == IS_UNDEF)) {
                op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
-       } else if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_CV)) && UNEXPECTED(Z_ISREF_P(op1))) {
+       } else if (((IS_TMP_VAR|IS_VAR) & IS_VAR) && UNEXPECTED(Z_ISREF_P(op1))) {
                /* Don't keep lock on reference, lock the value instead */
                if (UNEXPECTED(Z_REFCOUNT_P(op1) == 1)) {
                        ZVAL_UNREF(op1);
@@ -44256,7 +44256,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CASE_SPEC_TMPVAR_CV_HANDLER(ZE
        SAVE_OPLINE();
        if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_TYPE_P(op1) == IS_UNDEF)) {
                op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
-       } else if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_CV)) && UNEXPECTED(Z_ISREF_P(op1))) {
+       } else if (((IS_TMP_VAR|IS_VAR) & IS_VAR) && UNEXPECTED(Z_ISREF_P(op1))) {
                /* Don't keep lock on reference, lock the value instead */
                if (UNEXPECTED(Z_REFCOUNT_P(op1) == 1)) {
                        ZVAL_UNREF(op1);
@@ -45403,7 +45403,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CASE_SPEC_TMPVAR_TMPVAR_HANDLE
        SAVE_OPLINE();
        if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_TYPE_P(op1) == IS_UNDEF)) {
                op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
-       } else if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_CV)) && UNEXPECTED(Z_ISREF_P(op1))) {
+       } else if (((IS_TMP_VAR|IS_VAR) & IS_VAR) && UNEXPECTED(Z_ISREF_P(op1))) {
                /* Don't keep lock on reference, lock the value instead */
                if (UNEXPECTED(Z_REFCOUNT_P(op1) == 1)) {
                        ZVAL_UNREF(op1);