Fix throw by reference

Reported by Timm Friebe

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 0518d7c71d6940f5205c328fc88f9db5f69d223e..7657b6dcc1a5355649caf76b41046947ed05ca5f 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2917,7 +2917,7 @@ ZEND_VM_HANDLER(108, ZEND_THROW, CONST|TMP|VAR|CV, ANY)
        zend_free_op free_op1;
 
        SAVE_OPLINE();
-       value = GET_OP1_ZVAL_PTR(BP_VAR_R);
+       value = GET_OP1_ZVAL_PTR_DEREF(BP_VAR_R);
 
        if (OP1_TYPE == IS_CONST || UNEXPECTED(Z_TYPE_P(value) != IS_OBJECT)) {
                if (UNEXPECTED(EG(exception) != NULL)) {

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 5ba7e417572b9e70557c21cc2d018aca4ba954c8..e803acbdaa1346226117b84505410d86e6d79bc5 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -12846,7 +12846,7 @@ static int ZEND_FASTCALL  ZEND_THROW_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zend_free_op free_op1;
 
        SAVE_OPLINE();
-       value = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
+       value = _get_zval_ptr_var_deref(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
 
        if (IS_VAR == IS_CONST || UNEXPECTED(Z_TYPE_P(value) != IS_OBJECT)) {
                if (UNEXPECTED(EG(exception) != NULL)) {
@@ -29909,7 +29909,7 @@ static int ZEND_FASTCALL  ZEND_THROW_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 
 
        SAVE_OPLINE();
-       value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
+       value = _get_zval_ptr_cv_deref_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
 
        if (IS_CV == IS_CONST || UNEXPECTED(Z_TYPE_P(value) != IS_OBJECT)) {
                if (UNEXPECTED(EG(exception) != NULL)) {