Fixed bug #70223 (Incrementing value returned by magic getter)

diff --git a/NEWS b/NEWS
index bd0a195fbec7bfcc495787d483c4b09b20284a6a..e8731812493fdae6a128f89b268370a02112175f 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,7 @@ PHP                                                                        NEWS
 20 Aug 2015, PHP 7.0.0 RC 1
 
 - Core:
+  . Fixed bug #70223 (Incrementing value returned by magic getter). (Laruence)
   . Fixed bug #70215 (Segfault when __invoke is static). (Bob)
 
 - CLI server:

diff --git a/Zend/tests/bug70223.phpt b/Zend/tests/bug70223.phpt
new file mode 100644 (file)
index 0000000..7f1633a
--- /dev/null
+++ b/Zend/tests/bug70223.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #70223 (Incrementing value returned by magic getter)
+--FILE--
+<?php
+
+class A {
+
+    private $foo = 0;
+
+    public function &__get($foo){ return $this->foo; }
+
+}
+
+$a = new A;
+echo $a->f++;
+echo $a->f++;
+echo $a->f++;
+?>
+--EXPECT--
+012

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index b9a7ecfe1b339583670a9f6bcbdf80ef930cf948..090965611cc0ca5c32aa7d5817e9ab432545d2b3 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1339,14 +1339,18 @@ static zend_never_inline void zend_post_incdec_overloaded_property(zval *object,
                        }
                        ZVAL_COPY_VALUE(z, value);
                }
-               ZVAL_COPY(result, z);
-               ZVAL_DUP(&z_copy, z);
+
+               if (UNEXPECTED(Z_TYPE_P(z) == IS_REFERENCE)) {
+                       ZVAL_COPY(result, Z_REFVAL_P(z));
+               } else {
+                       ZVAL_COPY(result, z);
+               }
+               ZVAL_DUP(&z_copy, result);
                if (inc) {
                        increment_function(&z_copy);
                } else {
                        decrement_function(&z_copy);
                }
-               if (Z_REFCOUNTED_P(z)) Z_ADDREF_P(z);
                Z_OBJ_HT(obj)->write_property(&obj, property, &z_copy, cache_slot);
                OBJ_RELEASE(Z_OBJ(obj));
                zval_ptr_dtor(&z_copy);