Fixed ArrayAccess behavior

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 7fcc67fc80681c5f0792f7160daaf5beda23e40b..c3f1e31e192622c2fe3ec6abb2067c724dd49650 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1264,14 +1264,24 @@ convert_to_array:
 
                                if (overloaded_result && Z_TYPE_P(overloaded_result) != IS_UNDEF) {
                                        if (!Z_ISREF_P(overloaded_result)) {
-//???                                          if (Z_REFCOUNT_P(overloaded_result) > 0) {
+                                               if (Z_REFCOUNTED_P(overloaded_result) && Z_REFCOUNT_P(overloaded_result) > 1) {
+//???
+#if 1
+                                                       Z_DELREF_P(overloaded_result);
+                            if (Z_ISREF_P(overloaded_result)) {
+                                                               overloaded_result = Z_REFVAL_P(overloaded_result);
+                            }
+                                                       ZVAL_DUP(result, overloaded_result);
+                                                       overloaded_result = result;
+#else
 //???                                                  zval *tmp = overloaded_result;
 //???
 //???                                                  ALLOC_ZVAL(overloaded_result);
 //???                                                  ZVAL_DUP(overloaded_result, tmp);
 //???                                                  Z_UNSET_ISREF_P(overloaded_result);
 //???                                                  Z_SET_REFCOUNT_P(overloaded_result, 0);
-//???                                          }
+#endif
+                                               }
                                                if (Z_TYPE_P(overloaded_result) != IS_OBJECT) {
                                                        zend_class_entry *ce = Z_OBJCE_P(container);
                                                        zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ce->name->val);

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 7b604493e37563d12d98a17ec763a841f11cec10..bc2d2763b4433ccd165adea4e402d55166e147e1 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1232,7 +1232,7 @@ ZEND_VM_HANDLER(87, ZEND_FETCH_DIM_RW, VAR|CV, CONST|TMP|VAR|UNUSED|CV)
        zval *container;
 
        SAVE_OPLINE();
-       container = GET_OP1_ZVAL_PTR(BP_VAR_RW);
+       container = GET_OP1_ZVAL_PTR_PTR(BP_VAR_RW);
 
        if (OP1_TYPE == IS_VAR && UNEXPECTED(Z_TYPE_P(container) == IS_STR_OFFSET)) {
                zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 8d01ddf79feda0139a57f52782539ddd27c72265..c1330dae30a367eca4f90fb83509a96c8614d7b7 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -14668,7 +14668,7 @@ static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_H
        zval *container;
 
        SAVE_OPLINE();
-       container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
+       container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
 
        if (IS_VAR == IS_VAR && UNEXPECTED(Z_TYPE_P(container) == IS_STR_OFFSET)) {
                zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
@@ -16988,7 +16988,7 @@ static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HAN
        zval *container;
 
        SAVE_OPLINE();
-       container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
+       container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
 
        if (IS_VAR == IS_VAR && UNEXPECTED(Z_TYPE_P(container) == IS_STR_OFFSET)) {
                zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
@@ -19205,7 +19205,7 @@ static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HAN
        zval *container;
 
        SAVE_OPLINE();
-       container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
+       container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
 
        if (IS_VAR == IS_VAR && UNEXPECTED(Z_TYPE_P(container) == IS_STR_OFFSET)) {
                zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
@@ -21160,7 +21160,7 @@ static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_
        zval *container;
 
        SAVE_OPLINE();
-       container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
+       container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
 
        if (IS_VAR == IS_VAR && UNEXPECTED(Z_TYPE_P(container) == IS_STR_OFFSET)) {
                zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");
@@ -22619,7 +22619,7 @@ static int ZEND_FASTCALL  ZEND_FETCH_DIM_RW_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HAND
        zval *container;
 
        SAVE_OPLINE();
-       container = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
+       container = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
 
        if (IS_VAR == IS_VAR && UNEXPECTED(Z_TYPE_P(container) == IS_STR_OFFSET)) {
                zend_error_noreturn(E_ERROR, "Cannot use string offset as an array");