Fixed bug #42119 (array_push($arr,&$obj) doesn't work with zend.ze1_compatibility_mod...

diff --git a/NEWS b/NEWS
index e17841036ad9d1fc5f62ac661f0330f5c9f887c2..6d391895f3da85735e4325907c8ce8d4df867f96 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -78,6 +78,8 @@ PHP                                                                        NEWS
   (Ilia)
 - Fixed bug #42134 (oci_error() returns false after oci_new_collection() 
   fails). (Tony)
+- Fixed bug #42119 (array_push($arr,&$obj) doesn't work with
+  zend.ze1_compatibility_mode On). (Dmitry)
 - Fixed Bug #42112 (deleting a node produces memory corruption). (Rob)
 - Fixed Bug #42107 (sscanf broken when using %2$s format parameters). (Jani)
 - Fixed bug #42090 (json_decode causes segmentation fault). (Hannes)

diff --git a/Zend/tests/bug42119.phpt b/Zend/tests/bug42119.phpt
new file mode 100755 (executable)
index 0000000..79d70f0
--- /dev/null
+++ b/Zend/tests/bug42119.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #42119 (array_push($arr,&$obj) doesn't work with zend.ze1_compatibility_mode On)
+--INI--
+allow_call_time_pass_reference=1
+zend.ze1_compatibility_mode=1
+--FILE--
+<?php
+class myclass {
+  var $item = 1;
+}
+
+$arr = array();
+@$myobj = new myclass();
+array_push($arr,&$myobj);
+$myobj->item = 2;
+echo $arr[0]->item,"\n";
+?>
+--EXPECT--
+2

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index 96aaa47c9f43854b8c7b9e1574cec9532621eb20..5092e8ca72983cbabd5d10a82a7691e5fc11f23f 100644 (file)
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -154,7 +154,9 @@ ZEND_API int _zend_get_parameters_array_ex(int param_count, zval ***argument_arr
        while (param_count-->0) {
                zval **value = (zval**)(p-arg_count);
 
-               if (EG(ze1_compatibility_mode) && Z_TYPE_PP(value) == IS_OBJECT) {
+               if (EG(ze1_compatibility_mode) &&
+                   Z_TYPE_PP(value) == IS_OBJECT &&
+                   !(*value)->is_ref) {
                        zval *value_ptr;
                        char *class_name;
                        zend_uint class_name_len;