Fix bug #11970

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index b99f1acf120e9c52f4cb8c6c9b75a8e0962db0d6..668ab19fe40b26b51066ce3bb24788f7542213d9 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1650,9 +1650,14 @@ do_fcall_common:
                                                
                                                retval_ptr_ptr = get_zval_ptr_ptr(&opline->op1, Ts, BP_VAR_W);
 
-                                               SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr_ptr);
+                                               if (*retval_ptr_ptr==EG(uninitialized_zval_ptr)
+                                                       || *retval_ptr_ptr==EG(error_zval_ptr)) {
+                                                       ALLOC_INIT_ZVAL(*retval_ptr_ptr);
+                                               } else {
+                                                       SEPARATE_ZVAL_TO_MAKE_IS_REF(retval_ptr_ptr);
+                                                       (*retval_ptr_ptr)->refcount++;
+                                               }
                                                
-                                               (*retval_ptr_ptr)->refcount++;
                                                (*EG(return_value_ptr_ptr)) = (*retval_ptr_ptr);
                                        } else {
                                                retval_ptr = get_zval_ptr(&opline->op1, Ts, &EG(free_op1), BP_VAR_R);