Also protects object to array cast

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 5cbe393d14688037f6c92e2870f8b8e9f076c5e0..50557e56d80dbd97fd46f2e347e157f266e85498 100644 (file)
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -597,7 +597,9 @@ try_again:
                                        if (obj_ht) {
                                                zval arr;
 
-                                               if (!Z_OBJCE_P(op)->default_properties_count && obj_ht == Z_OBJ_P(op)->properties) {
+                                               if (!Z_OBJCE_P(op)->default_properties_count &&
+                                                       obj_ht == Z_OBJ_P(op)->properties &&
+                                                       !ZEND_HASH_GET_APPLY_COUNT(Z_OBJ_P(op)->properties)) {
                                                        /* fast copy */
                                                        if (EXPECTED(Z_OBJ_P(op)->handlers == &std_object_handlers)) {
                                                                ZVAL_ARR(&arr, obj_ht);