MFH(r-1.114) Can't use real arrays held by ArrayObjects in write context

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 137d0cd42ea7d35b0b593698b422f83936e5c1d8..76af597da0af458441ef397a05a0bb4c107d7594 100755 (executable)
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -299,6 +299,8 @@ static zval **spl_array_get_dimension_ptr_ptr(int check_inherited, zval *object,
 
 static zval *spl_array_read_dimension_ex(int check_inherited, zval *object, zval *offset, int type TSRMLS_DC) /* {{{ */
 {
+       zval **ret;
+
        if (check_inherited) {
                spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC);
                if (intern->fptr_offset_get) {
@@ -315,7 +317,30 @@ static zval *spl_array_read_dimension_ex(int check_inherited, zval *object, zval
                        return EG(uninitialized_zval_ptr);
                }
        }
-       return *spl_array_get_dimension_ptr_ptr(check_inherited, object, offset, type TSRMLS_CC);
+       ret = spl_array_get_dimension_ptr_ptr(check_inherited, object, offset, type TSRMLS_CC);
+
+       /* When in a write context,
+        * ZE has to be fooled into thinking this is in a reference set
+        * by separating (if necessary) and returning as an is_ref=1 zval (even if refcount == 1) */
+       if ((type == BP_VAR_W || type == BP_VAR_RW) && !(*ret)->is_ref) {
+               if ((*ret)->refcount > 1) {
+                       zval *newval;
+
+                       /* Separate */
+                       MAKE_STD_ZVAL(newval);
+                       *newval = **ret;
+                       zval_copy_ctor(newval);
+                       newval->refcount = 1;
+
+                       /* Replace */
+                       (*ret)->refcount--;
+                       *ret = newval;
+               }
+
+               (*ret)->is_ref = 1;
+       }
+
+       return *ret;
 } /* }}} */
 
 static zval *spl_array_read_dimension(zval *object, zval *offset, int type TSRMLS_DC) /* {{{ */

diff --git a/ext/spl/tests/iterator_035.phpt b/ext/spl/tests/iterator_035.phpt
index eebc7f22a43a804f11610280c3b3dd17fdbef4bc..9dfe35d5f4bfaa39c8a03fb1a485ee72229f6898 100644 (file)
--- a/ext/spl/tests/iterator_035.phpt
+++ b/ext/spl/tests/iterator_035.phpt
@@ -14,4 +14,4 @@ $a[] = &$tmp;
 echo "Done\n";
 ?>
 --EXPECTF--    
-Fatal error: Objects used as arrays in post/pre increment/decrement must return values by reference in %s on line %d
+Fatal error: Cannot assign by reference to overloaded object in %s on line %d