Minor fixes:

	missing zval_copy_ctor()
	messed up AiCount fix

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 65ffdf30ea86f53ec1645e1e3529f650136bb02a..f661beb3080a3edbbe5a27feb8e99b2583051d5d 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -1438,6 +1438,7 @@ void do_list_end(znode *result, znode *expr CLS_DC)
        le = CG(list_llist).head;
        while (le) {
                do_assign(result, &((list_llist_element *) le->data)->var, &((list_llist_element *) le->data)->value CLS_CC);
+               EG(active_op_array)->opcodes[EG(active_op_array)->last-1].result.u.EA.type |= EXT_TYPE_UNUSED;
                le = le->next;
        }
        zend_llist_destroy(&CG(dimension_llist));

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 5683e93a8b60c5502d7bd75a1320e4aade6289e4..01b19c3c1de4ec4d5caa8c230a41ea641ff37aeb 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1453,6 +1453,7 @@ send_by_ref:
                                                        **varptr_ptr = *varptr;
                                                        varptr = *varptr_ptr;
                                                        varptr->refcount = 1;
+                                                       zval_copy_ctor(varptr);
                                                }
                                                varptr->is_ref = 1;
                                                /* at the end of this code refcount is always 1 */