Fixes

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 2e30fc170b5722d1579ffd901c8bb5a5ceb9fd96..1bac5e2f9630cf0bda50dc5b83259d32534a2a52 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -346,7 +346,7 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2
                        variable_ptr->is_ref = 1;
                        if (type!=IS_TMP_VAR) {
                                zendi_zval_copy_ctor(*variable_ptr);
-                               
+                               value->refcount--;
                        }
                }
        } else {

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index c56a876f164cec2e1d5a659c6f6ff41637239f5e..8c610ef30180240cf2ddcad1cff4132e44a9fbf8 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -487,7 +487,7 @@ ZEND_API inline void zend_assign_to_variable_reference(znode *result, zval **var
        if (variable_ptr == EG(error_zval_ptr) || value_ptr==EG(error_zval_ptr)) {
                variable_ptr_ptr = &EG(uninitialized_zval_ptr);
 /*     } else if (variable_ptr==&EG(uninitialized_zval) || variable_ptr!=value_ptr) { */
-       } else if (*variable_ptr_ptr != *value_ptr_ptr) {
+       } else if (variable_ptr_ptr != value_ptr_ptr) {
                variable_ptr->refcount--;
                if (variable_ptr->refcount==0) {
                        zendi_zval_dtor(*variable_ptr);
@@ -510,7 +510,10 @@ ZEND_API inline void zend_assign_to_variable_reference(znode *result, zval **var
                *variable_ptr_ptr = value_ptr;
                value_ptr->refcount++;
        } else {
-               /* nothing to do */
+               if (variable_ptr->refcount>1) { /* we need to break away */
+                       SEPARATE_ZVAL(variable_ptr_ptr);
+               }
+               (*variable_ptr_ptr)->is_ref = 1;
        }
 
        if (result && (result->op_type != IS_UNUSED)) {