Fixed bug #35393 (changing static protected members from outside the class, one more...

diff --git a/Zend/tests/bug35393.phpt b/Zend/tests/bug35393.phpt
new file mode 100755 (executable)
index 0000000..ce3bdd0
--- /dev/null
+++ b/Zend/tests/bug35393.phpt
@@ -0,0 +1,30 @@
+--TEST--
+Bug #35393 (changing static protected members from outside the class)
+--INI--
+error_reporting=4095
+--FILE--
+<?php
+class ObjectPath
+{
+    static protected $type = array(0=>'main');
+
+    static function getType()
+    {
+        return self::$type;
+    }
+}
+print_r(ObjectPath::getType());
+$object_type = array_pop((ObjectPath::getType()));
+print_r(ObjectPath::getType());
+?>
+--EXPECTF--
+Array
+(
+    [0] => main
+)
+
+Strict Standards: Only variables should be passed by reference in %sbug35393.php on line 12
+Array
+(
+    [0] => main
+)

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 30d10c848cbd4a6948a49f1c53437107e72bbb09..30aad585154400327dc96bf90d8f9de9eeab9687 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2219,7 +2219,8 @@ ZEND_VM_HANDLER(106, ZEND_SEND_VAR_NO_REF, VAR|CV, ANY)
        if ((!(opline->extended_value & ZEND_ARG_SEND_FUNCTION) ||
             EX_T(opline->op1.u.var).var.fcall_returned_reference) &&
            varptr != &EG(uninitialized_zval) && 
-           (PZVAL_IS_REF(varptr) || varptr->refcount == 1)) {
+           (PZVAL_IS_REF(varptr) || 
+            (varptr->refcount == 1 && (OP1_TYPE == IS_CV || free_op1.var)))) {
                varptr->is_ref = 1;
                varptr->refcount++;
                zend_ptr_stack_push(&EG(argument_stack), varptr);

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 3cd4b3ecc19b83677899920748a6d386942c2123..55a0f4afed2c31d9dec8326f773e51d696e34e16 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -7201,7 +7201,8 @@ static int ZEND_SEND_VAR_NO_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        if ((!(opline->extended_value & ZEND_ARG_SEND_FUNCTION) ||
             EX_T(opline->op1.u.var).var.fcall_returned_reference) &&
            varptr != &EG(uninitialized_zval) && 
-           (PZVAL_IS_REF(varptr) || varptr->refcount == 1)) {
+           (PZVAL_IS_REF(varptr) || 
+            (varptr->refcount == 1 && (IS_VAR == IS_CV || free_op1.var)))) {
                varptr->is_ref = 1;
                varptr->refcount++;
                zend_ptr_stack_push(&EG(argument_stack), varptr);
@@ -19878,7 +19879,7 @@ static int zend_send_by_var_helper_SPEC_CV(ZEND_OPCODE_HANDLER_ARGS)
 static int ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
        zend_op *opline = EX(opline);
-       
+       zend_free_op free_op1;
        zval *varptr;
 
        if (opline->extended_value & ZEND_ARG_COMPILE_TIME_BOUND) { /* Had function_ptr at compile_time */
@@ -19893,7 +19894,8 @@ static int ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        if ((!(opline->extended_value & ZEND_ARG_SEND_FUNCTION) ||
             EX_T(opline->op1.u.var).var.fcall_returned_reference) &&
            varptr != &EG(uninitialized_zval) && 
-           (PZVAL_IS_REF(varptr) || varptr->refcount == 1)) {
+           (PZVAL_IS_REF(varptr) || 
+            (varptr->refcount == 1 && (IS_CV == IS_CV || free_op1.var)))) {
                varptr->is_ref = 1;
                varptr->refcount++;
                zend_ptr_stack_push(&EG(argument_stack), varptr);

diff --git a/ext/standard/tests/file/proc_open01.phpt b/ext/standard/tests/file/proc_open01.phpt
index 39fc4e4cf6b15c027ed2f33d66bae5e040073365..c5b0ed971b84c3a0fef014b7017d31ce708eabf3 100644 (file)
--- a/ext/standard/tests/file/proc_open01.phpt
+++ b/ext/standard/tests/file/proc_open01.phpt
@@ -30,7 +30,9 @@ for ($left = strlen($test_string); $left > 0;) {
          break;
        }
        $read_fds = array($pipes[1]);
-       $retval = stream_select($read_fds, $write_fds = NULL, $exp_fds = NULL, 1);
+       $write_fds = NULL;
+       $exp_fds = NULL;
+       $retval = stream_select($read_fds, $write_fds, $exp_fds, 1);
        if ($retval === false) {
                print "select() failed\n";
                break;