Fixed bug #43505 (Assign by reference bug)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 390012c107c1ce7a9a96dba51d37eba4e3addde5..bf472e10a2b4af6d836ff71503871a1c8f947337 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -324,7 +324,7 @@ PHP_FUNCTION(count)
                        if (Z_OBJ_HT_P(array)->get_class_entry && instanceof_function(Z_OBJCE_P(array), spl_ce_Countable TSRMLS_CC)) {
                                zend_call_method_with_0_params(&array, NULL, NULL, "count", &retval);
                                if (retval) {
-                                       convert_to_long(retval);
+                                       convert_to_long_ex(&retval);
                                        RETVAL_LONG(Z_LVAL_P(retval));
                                        zval_ptr_dtor(&retval);
                                }

diff --git a/ext/standard/tests/array/bug43505.phpt b/ext/standard/tests/array/bug43505.phpt
new file mode 100644 (file)
index 0000000..72d26b6
--- /dev/null
+++ b/ext/standard/tests/array/bug43505.phpt
@@ -0,0 +1,43 @@
+--TEST--
+Bug #43505 (Assign by reference bug)
+--INI--
+error_reporting=0
+--FILE--
+<?php
+class Test implements Countable {
+    public function count() {
+        return $some;
+    }
+}
+
+$obj = new Test();
+
+$a = array();
+$b =& $a['test'];
+var_dump($a);
+
+$t = count($obj);
+
+$a = array();
+$b =& $a['test'];
+var_dump($a);
+?>
+--EXPECT--
+array(1) {
+  ["test"]=>
+  &NULL
+}
+array(1) {
+  ["test"]=>
+  &NULL
+}
+--UEXPECT--
+array(1) {
+  [u"test"]=>
+  &NULL
+}
+array(1) {
+  [u"test"]=>
+  &NULL
+}
+