Fixed passing argument by refefence from internal functions

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 73c00eae0397a014288d487086f0de6f050bd981..4ffa199d4494010aae181b0a9504c79edf5f5975 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -867,10 +867,8 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
                                ZVAL_NEW_REF(&fci->params[i], &tmp);
                                Z_ADDREF(fci->params[i]);
                        } else if (!Z_ISREF(fci->params[i])) {
-                               if (Z_REFCOUNTED(fci->params[i])) {
-                                       Z_ADDREF(fci->params[i]);
-                               }
                                ZVAL_NEW_REF(&fci->params[i], &fci->params[i]);
+                               Z_ADDREF(fci->params[i]);
                        } else if (Z_REFCOUNTED(fci->params[i])) {
                                Z_ADDREF(fci->params[i]);
                        }

diff --git a/Zend/zend_interfaces.c b/Zend/zend_interfaces.c
index 361a8ce9ab2231cb59156f637d8a52e8a8e307d5..4f36c91f2e56a0d48158e581f9b919768a827451 100644 (file)
--- a/Zend/zend_interfaces.c
+++ b/Zend/zend_interfaces.c
@@ -113,6 +113,13 @@ ZEND_API zval* zend_call_method(zval *object, zend_class_entry *obj_ce, zend_fun
                        zend_error(E_CORE_ERROR, "Couldn't execute method %s%s%s", obj_ce ? obj_ce->name->val : "", obj_ce ? "::" : "", function_name);
                }
        }
+       /* copy arguments back, they might be changed by references */
+       if (param_count > 0) {
+               ZVAL_COPY_VALUE(arg1, &params[0]);
+       }
+       if (param_count > 1) {
+               ZVAL_COPY_VALUE(arg2, &params[1]);
+       }
        if (!retval_ptr) {
                zval_ptr_dtor(&retval);
                return NULL;

diff --git a/Zend/zend_variables.c b/Zend/zend_variables.c
index c7faba8bfe4b2eac43777fa4e5b477ae204d458a..995a648ef34822fcb028a828da6c8c4c38304c67 100644 (file)
--- a/Zend/zend_variables.c
+++ b/Zend/zend_variables.c
@@ -78,7 +78,7 @@ ZEND_API void _zval_dtor_func(zend_refcounted *p ZEND_FILE_LINE_DC)
                case IS_REFERENCE: {
                                zend_reference *ref = (zend_reference*)p;
                                if (--ref->gc.refcount == 0) {
-                                       zval_dtor(&ref->val);
+                                       zval_ptr_dtor(&ref->val);
                                        goto gc_exit;
                                }
                                goto exit;
@@ -142,7 +142,7 @@ ZEND_API void _zval_dtor_func_for_ptr(zend_refcounted *p ZEND_FILE_LINE_DC)
                case IS_REFERENCE: {
                                zend_reference *ref = (zend_reference*)p;
 
-                               zval_dtor(&ref->val);
+                               zval_ptr_dtor(&ref->val);
                                goto gc_exit;
                        }
                default: