Fixed memory leak (Bob)

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 326c719c65b318c6209b06f3c2916db5a4a97150..dc3db0f9fef0964fcd19938881f5130038bdb173 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1412,11 +1412,11 @@ static zend_never_inline void zend_pre_incdec_overloaded_property(zval *object,
        zval rv;
 
        if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-               zval *z, obj;
+               zval *z, *zptr, obj;
                                
                ZVAL_OBJ(&obj, Z_OBJ_P(object));
                Z_ADDREF(obj);
-               z = Z_OBJ_HT(obj)->read_property(&obj, property, BP_VAR_R, cache_slot, &rv);
+               zptr = z = Z_OBJ_HT(obj)->read_property(&obj, property, BP_VAR_R, cache_slot, &rv);
                if (UNEXPECTED(EG(exception))) {
                        OBJ_RELEASE(Z_OBJ(obj));
                        return;
@@ -1443,7 +1443,7 @@ static zend_never_inline void zend_pre_incdec_overloaded_property(zval *object,
                }
                Z_OBJ_HT(obj)->write_property(&obj, property, z, cache_slot);
                OBJ_RELEASE(Z_OBJ(obj));
-               zval_ptr_dtor(z);
+               zval_ptr_dtor(zptr);
        } else {
                zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
                if (UNEXPECTED(result)) {

diff --git a/tests/lang/operators/overloaded_property_ref.phpt b/tests/lang/operators/overloaded_property_ref.phpt
new file mode 100644 (file)
index 0000000..7561fc9
--- /dev/null
+++ b/tests/lang/operators/overloaded_property_ref.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Operators on overlaoded property reference
+--FILE--
+<?php
+class C {
+       function __construct() { $this->bar = str_repeat("1", 2); }
+       function &__get($x) { return $this->bar; }
+       function __set($x, $v) { $this->bar = $v; }
+}
+$x = new C;
+var_dump(++$x->foo);
+$x = new C;
+var_dump($x->foo++);
+$x = new C;
+var_dump($x->foo += 2);
+?>
+--EXPECT--
+int(12)
+string(2) "11"
+int(13)