Fixed bug #43201 (Crash on using unitialized vals and __get/__set)

diff --git a/NEWS b/NEWS
index 769831bf86cd576de7183de6c2a6909a4f0ddc1b..f3fa057c25f4c29ba220692ac79bd7ab2cf0418a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2008, PHP 5.2.6
+- Fixed bug #43201 (Crash on using unitialized vals and __get/__set). (Dmitry)
 - Fixed bug #43175 (__destruct() throwing an exception with __call() causes
   segfault). (Dmitry)
 

diff --git a/Zend/tests/bug43201.phpt b/Zend/tests/bug43201.phpt
new file mode 100755 (executable)
index 0000000..89e1b66
--- /dev/null
+++ b/Zend/tests/bug43201.phpt
@@ -0,0 +1,54 @@
+--TEST--
+Bug #43201 (Crash on using unitialized vals and __get/__set)
+--FILE--
+<?php
+class Foo {
+       function __get($k) {
+               return null;
+       }
+       function __set($k, $v) {
+               $this->$k = $v;
+       }
+}
+
+$c = new Foo();
+
+$c->arr[0]["k"] = 1;
+$c->arr[0]["k2"] = $ref;
+for($cnt=0;$cnt<6;$cnt++) {
+       $ref = chop($undef);    
+       $c->arr[$cnt]["k2"] = $ref;
+}
+echo "ok\n";
+?>
+--EXPECTF--
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 13
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 14
+
+Notice: Undefined variable: ref in %sbug43201.php on line 14
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+ok

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index c3919f166d039ede08846c0996e8454be42adf95..63fb3f6981d2c373d1882e9b99d0a4acb93c138d 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1064,6 +1064,10 @@ ZEND_VM_HANDLER(84, ZEND_FETCH_DIM_W, VAR|CV, CONST|TMP|VAR|UNUSED|CV)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        FREE_OP1_VAR_PTR();
        ZEND_VM_NEXT_OPCODE();
@@ -1081,6 +1085,10 @@ ZEND_VM_HANDLER(87, ZEND_FETCH_DIM_RW, VAR|CV, CONST|TMP|VAR|UNUSED|CV)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        FREE_OP1_VAR_PTR();
        ZEND_VM_NEXT_OPCODE();
@@ -1115,6 +1123,10 @@ ZEND_VM_HANDLER(93, ZEND_FETCH_DIM_FUNC_ARG, VAR|CV, CONST|TMP|VAR|UNUSED|CV)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        FREE_OP1_VAR_PTR();
        ZEND_VM_NEXT_OPCODE();
@@ -1143,6 +1155,10 @@ ZEND_VM_HANDLER(96, ZEND_FETCH_DIM_UNSET, VAR|CV, CONST|TMP|VAR|CV)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        FREE_OP1_VAR_PTR();
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -1249,6 +1265,10 @@ ZEND_VM_HANDLER(85, ZEND_FETCH_OBJ_W, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        FREE_OP1_VAR_PTR();
        ZEND_VM_NEXT_OPCODE();
@@ -1273,6 +1293,10 @@ ZEND_VM_HANDLER(88, ZEND_FETCH_OBJ_RW, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        FREE_OP1_VAR_PTR();
        ZEND_VM_NEXT_OPCODE();
@@ -1305,6 +1329,10 @@ ZEND_VM_HANDLER(94, ZEND_FETCH_OBJ_FUNC_ARG, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
                FREE_OP1_VAR_PTR();
                ZEND_VM_NEXT_OPCODE();
@@ -1338,6 +1366,10 @@ ZEND_VM_HANDLER(97, ZEND_FETCH_OBJ_UNSET, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        FREE_OP1_VAR_PTR();
 

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 8f8fdf3258b4fc6bd572284910250dbc8f02fe35..17d45e1ac86cfd901252c8158cd14d9c1ae0d69b 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -8955,6 +8955,10 @@ static int ZEND_FETCH_DIM_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -8972,6 +8976,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -9006,6 +9014,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_AR
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -9034,6 +9046,10 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -9140,6 +9156,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -9164,6 +9184,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -9196,6 +9220,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_AR
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
                if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
                ZEND_VM_NEXT_OPCODE();
@@ -9229,6 +9257,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
 
@@ -10440,6 +10472,10 @@ static int ZEND_FETCH_DIM_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -10457,6 +10493,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -10491,6 +10531,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -10519,6 +10563,10 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -10625,6 +10673,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -10649,6 +10701,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -10681,6 +10737,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
                if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
                ZEND_VM_NEXT_OPCODE();
@@ -10714,6 +10774,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
 
@@ -11928,6 +11992,10 @@ static int ZEND_FETCH_DIM_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -11945,6 +12013,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -11979,6 +12051,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -12007,6 +12083,10 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -12113,6 +12193,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -12137,6 +12221,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -12169,6 +12257,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
                if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
                ZEND_VM_NEXT_OPCODE();
@@ -12202,6 +12294,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
 
@@ -13019,6 +13115,10 @@ static int ZEND_FETCH_DIM_W_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -13036,6 +13136,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -13058,6 +13162,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_A
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -13888,6 +13996,10 @@ static int ZEND_FETCH_DIM_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -13905,6 +14017,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -13939,6 +14055,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -13967,6 +14087,10 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -14073,6 +14197,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -14097,6 +14225,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -14129,6 +14261,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
                if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
                ZEND_VM_NEXT_OPCODE();
@@ -14162,6 +14298,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
 
@@ -15313,6 +15453,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -15337,6 +15481,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -15369,6 +15517,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
 
                ZEND_VM_NEXT_OPCODE();
@@ -15402,6 +15554,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_AR
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        PZVAL_UNLOCK(*EX_T(opline->result.u.var).var.ptr_ptr, &free_res);
@@ -16321,6 +16477,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -16345,6 +16505,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -16377,6 +16541,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_A
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
 
                ZEND_VM_NEXT_OPCODE();
@@ -16410,6 +16578,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        PZVAL_UNLOCK(*EX_T(opline->result.u.var).var.ptr_ptr, &free_res);
@@ -17285,6 +17457,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -17309,6 +17485,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -17341,6 +17521,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_A
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
 
                ZEND_VM_NEXT_OPCODE();
@@ -17374,6 +17558,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        PZVAL_UNLOCK(*EX_T(opline->result.u.var).var.ptr_ptr, &free_res);
@@ -18514,6 +18702,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -18538,6 +18730,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -18570,6 +18766,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_AR
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
 
                ZEND_VM_NEXT_OPCODE();
@@ -18603,6 +18803,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        PZVAL_UNLOCK(*EX_T(opline->result.u.var).var.ptr_ptr, &free_res);
@@ -20878,6 +21082,10 @@ static int ZEND_FETCH_DIM_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -20895,6 +21103,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -20929,6 +21141,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARG
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -20957,6 +21173,10 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -21062,6 +21282,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -21086,6 +21310,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -21118,6 +21346,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARG
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
 
                ZEND_VM_NEXT_OPCODE();
@@ -21151,6 +21383,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        PZVAL_UNLOCK(*EX_T(opline->result.u.var).var.ptr_ptr, &free_res);
@@ -22355,6 +22591,10 @@ static int ZEND_FETCH_DIM_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -22372,6 +22612,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -22406,6 +22650,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -22434,6 +22682,10 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -22539,6 +22791,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -22563,6 +22819,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -22595,6 +22855,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
 
                ZEND_VM_NEXT_OPCODE();
@@ -22628,6 +22892,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        PZVAL_UNLOCK(*EX_T(opline->result.u.var).var.ptr_ptr, &free_res);
@@ -23835,6 +24103,10 @@ static int ZEND_FETCH_DIM_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -23852,6 +24124,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -23886,6 +24162,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -23914,6 +24194,10 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -24019,6 +24303,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -24043,6 +24331,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -24075,6 +24367,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
 
                ZEND_VM_NEXT_OPCODE();
@@ -24108,6 +24404,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        PZVAL_UNLOCK(*EX_T(opline->result.u.var).var.ptr_ptr, &free_res);
@@ -24917,6 +25217,10 @@ static int ZEND_FETCH_DIM_W_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -24934,6 +25238,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -24956,6 +25264,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_AR
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -25785,6 +26097,10 @@ static int ZEND_FETCH_DIM_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -25802,6 +26118,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -25836,6 +26156,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -25864,6 +26188,10 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -25969,6 +26297,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -25993,6 +26325,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -26025,6 +26361,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
 
                ZEND_VM_NEXT_OPCODE();
@@ -26058,6 +26398,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   ZVAL_REFCOUNT(*EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        PZVAL_UNLOCK(*EX_T(opline->result.u.var).var.ptr_ptr, &free_res);