Fixed bug #54367 (Use of closure causes problem in ArrayAccess)

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 3717f43fbfff9c8f6b68bae4214a2f26f9fce940..8a3ec3b5d0a9d1b37cf3c73245a1e6ea11ba5ce8 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -433,26 +433,28 @@ ZEND_API zend_bool zend_is_executing(TSRMLS_D) /* {{{ */
 
 ZEND_API void _zval_ptr_dtor(zval **zval_ptr ZEND_FILE_LINE_DC) /* {{{ */
 {
+       zval *zv = *zval_ptr;
+
 #if DEBUG_ZEND>=2
        printf("Reducing refcount for %x (%x): %d->%d\n", *zval_ptr, zval_ptr, Z_REFCOUNT_PP(zval_ptr), Z_REFCOUNT_PP(zval_ptr) - 1);
 #endif
-       Z_DELREF_PP(zval_ptr);
-       if (Z_REFCOUNT_PP(zval_ptr) == 0) {
+       Z_DELREF_P(zv);
+       if (Z_REFCOUNT_P(zv) == 0) {
                TSRMLS_FETCH();
 
-               if (*zval_ptr != &EG(uninitialized_zval)) {
-                       GC_REMOVE_ZVAL_FROM_BUFFER(*zval_ptr);
-                       zval_dtor(*zval_ptr);
-                       efree_rel(*zval_ptr);
+               if (zv != &EG(uninitialized_zval)) {
+                       GC_REMOVE_ZVAL_FROM_BUFFER(zv);
+                       zval_dtor(zv);
+                       efree_rel(zv);
                }
        } else {
                TSRMLS_FETCH();
 
-               if (Z_REFCOUNT_PP(zval_ptr) == 1) {
-                       Z_UNSET_ISREF_PP(zval_ptr);
+               if (Z_REFCOUNT_P(zv) == 1) {
+                       Z_UNSET_ISREF_P(zv);
                }
 
-               GC_ZVAL_CHECK_POSSIBLE_ROOT(*zval_ptr);
+               GC_ZVAL_CHECK_POSSIBLE_ROOT(zv);
        }
 }
 /* }}} */