Fixed bug #43505 (Assign by reference bug)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index a66a9366e5c8d0c726a4fc6852b66a293d815a72..415469f94c9cdbe8450da50ef46a8158a9ec4545 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -318,7 +318,7 @@ PHP_FUNCTION(count)
                        if (Z_OBJ_HT_P(array)->get_class_entry && instanceof_function(Z_OBJCE_P(array), spl_ce_Countable TSRMLS_CC)) {
                                zend_call_method_with_0_params(&array, NULL, NULL, "count", &retval);
                                if (retval) {
-                                       convert_to_long(retval);
+                                       convert_to_long_ex(&retval);
                                        RETVAL_LONG(Z_LVAL_P(retval));
                                        zval_ptr_dtor(&retval);
                                }

diff --git a/ext/standard/tests/array/bug43505.phpt b/ext/standard/tests/array/bug43505.phpt
new file mode 100644 (file)
index 0000000..0a30479
--- /dev/null
+++ b/ext/standard/tests/array/bug43505.phpt
@@ -0,0 +1,34 @@
+--TEST--
+Bug #43505 (Assign by reference bug)
+--INI--
+error_reporting=0
+--FILE--
+<?php
+class Test implements Countable {
+    public function count() {
+        return $some;
+    }
+}
+
+$obj = new Test();
+
+$a = array();
+$b =& $a['test'];
+var_dump($a);
+
+$t = count($obj);
+
+$a = array();
+$b =& $a['test'];
+var_dump($a);
+?>
+--EXPECT--
+array(1) {
+  ["test"]=>
+  &NULL
+}
+array(1) {
+  ["test"]=>
+  &NULL
+}
+