Fixed bug #39017 (foreach(($obj = new myClass) as $v); echo $obj; segfaults)

diff --git a/NEWS b/NEWS
index 63314e3d717ed49ab6d87401346106676bf364b9..cabb18e6340f77e7b80d2046f937cac35647f586 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,8 @@ PHP                                                                        NEWS
 - Fixed mess with CGI/CLI -d option (now it works with cgi; constants are
   working exactly like in php.ini; with FastCGI -d affects all requests).
   (Dmitry)
+- Fixed bug #39017 (foreach(($obj = new myClass) as $v); echo $obj; segfaults).
+  (Dmitry)
 - Fixed bug #39004 (Fixed generation of config.nice with autoconf 2.60).
   (Ilia)
 - Fixed bug #39003 (__autoload() is called for type hinting). (Dmitry, Tony)

diff --git a/Zend/tests/bug39017.phpt b/Zend/tests/bug39017.phpt
new file mode 100755 (executable)
index 0000000..7020475
--- /dev/null
+++ b/Zend/tests/bug39017.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #39017 (foreach(($obj = new myClass) as $v); echo $obj; segfaults)
+--FILE--
+<?php
+class A {}
+foreach(($a=(object)new A()) as $v);
+var_dump($a); // UNKNOWN:0
+?>
+--EXPECTF--
+object(A)#%d (0) {
+}

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 074a48ea9945e86ffa289698a52732dbc1a7b48f..ef44ed108a1eb7a2d00b3b454150504a5e192f1a 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3106,6 +3106,9 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
                        array_ptr = tmp;
                } else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
                        ce = Z_OBJCE_P(array_ptr);
+                       if (!ce || !ce->get_iterator) {
+                               array_ptr->refcount++;
+                       }
                } else {
                        if (OP1_TYPE == IS_VAR &&
                                free_op1.var == NULL &&

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index aff983bd266159978ef7312014fa20bf0c980683..f23e6ab835133d03b4444775c4cf637faa85b7ec 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -2165,6 +2165,9 @@ static int ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        array_ptr = tmp;
                } else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
                        ce = Z_OBJCE_P(array_ptr);
+                       if (!ce || !ce->get_iterator) {
+                               array_ptr->refcount++;
+                       }
                } else {
                        if (IS_CONST == IS_VAR &&
                                free_op1.var == NULL &&
@@ -4701,6 +4704,9 @@ static int ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        array_ptr = tmp;
                } else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
                        ce = Z_OBJCE_P(array_ptr);
+                       if (!ce || !ce->get_iterator) {
+                               array_ptr->refcount++;
+                       }
                } else {
                        if (IS_TMP_VAR == IS_VAR &&
                                free_op1.var == NULL &&
@@ -7819,6 +7825,9 @@ static int ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        array_ptr = tmp;
                } else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
                        ce = Z_OBJCE_P(array_ptr);
+                       if (!ce || !ce->get_iterator) {
+                               array_ptr->refcount++;
+                       }
                } else {
                        if (IS_VAR == IS_VAR &&
                                free_op1.var == NULL &&
@@ -19853,6 +19862,9 @@ static int ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        array_ptr = tmp;
                } else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
                        ce = Z_OBJCE_P(array_ptr);
+                       if (!ce || !ce->get_iterator) {
+                               array_ptr->refcount++;
+                       }
                } else {
                        if (IS_CV == IS_VAR &&
                                free_op1.var == NULL &&