Fixed bug #69700 (tests/lang/this_assignment.phpt memory errors)

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index d3ca96819d1a3cfc82da0f6b409a3515ade046eb..76d1f547db3f60629df2a3158884f0d3eee6c1e5 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2986,7 +2986,8 @@ ZEND_VM_HANDLER(112, ZEND_INIT_METHOD_CALL, CONST|TMPVAR|UNUSED|CV, CONST|TMPVAR
        call_info = ZEND_CALL_NESTED_FUNCTION;
        if (UNEXPECTED((fbc->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                obj = NULL;
-       } else if (OP1_TYPE & (IS_VAR|IS_TMP_VAR)) {
+       } else if (OP1_TYPE & (IS_VAR|IS_TMP_VAR|IS_CV)) {
+               /* CV may be changed inderectly (e.g. when it's a reference) */
                call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_RELEASE_THIS;
                GC_REFCOUNT(obj)++; /* For $this pointer */
        }

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index c174ff46536d8b7e978752e800740de657742d09..4680c72d12fc97558f50275cba39078e0d7d471d 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -5647,7 +5647,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CONST_CO
        call_info = ZEND_CALL_NESTED_FUNCTION;
        if (UNEXPECTED((fbc->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                obj = NULL;
-       } else if (IS_CONST & (IS_VAR|IS_TMP_VAR)) {
+       } else if (IS_CONST & (IS_VAR|IS_TMP_VAR|IS_CV)) {
+               /* CV may be changed inderectly (e.g. when it's a reference) */
                call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_RELEASE_THIS;
                GC_REFCOUNT(obj)++; /* For $this pointer */
        }
@@ -9284,7 +9285,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CONST_CV
        call_info = ZEND_CALL_NESTED_FUNCTION;
        if (UNEXPECTED((fbc->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                obj = NULL;
-       } else if (IS_CONST & (IS_VAR|IS_TMP_VAR)) {
+       } else if (IS_CONST & (IS_VAR|IS_TMP_VAR|IS_CV)) {
+               /* CV may be changed inderectly (e.g. when it's a reference) */
                call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_RELEASE_THIS;
                GC_REFCOUNT(obj)++; /* For $this pointer */
        }
@@ -11009,7 +11011,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CONST_TM
        call_info = ZEND_CALL_NESTED_FUNCTION;
        if (UNEXPECTED((fbc->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                obj = NULL;
-       } else if (IS_CONST & (IS_VAR|IS_TMP_VAR)) {
+       } else if (IS_CONST & (IS_VAR|IS_TMP_VAR|IS_CV)) {
+               /* CV may be changed inderectly (e.g. when it's a reference) */
                call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_RELEASE_THIS;
                GC_REFCOUNT(obj)++; /* For $this pointer */
        }
@@ -23937,7 +23940,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_UNUSED_C
        call_info = ZEND_CALL_NESTED_FUNCTION;
        if (UNEXPECTED((fbc->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                obj = NULL;
-       } else if (IS_UNUSED & (IS_VAR|IS_TMP_VAR)) {
+       } else if (IS_UNUSED & (IS_VAR|IS_TMP_VAR|IS_CV)) {
+               /* CV may be changed inderectly (e.g. when it's a reference) */
                call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_RELEASE_THIS;
                GC_REFCOUNT(obj)++; /* For $this pointer */
        }
@@ -26350,7 +26354,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_UNUSED_C
        call_info = ZEND_CALL_NESTED_FUNCTION;
        if (UNEXPECTED((fbc->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                obj = NULL;
-       } else if (IS_UNUSED & (IS_VAR|IS_TMP_VAR)) {
+       } else if (IS_UNUSED & (IS_VAR|IS_TMP_VAR|IS_CV)) {
+               /* CV may be changed inderectly (e.g. when it's a reference) */
                call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_RELEASE_THIS;
                GC_REFCOUNT(obj)++; /* For $this pointer */
        }
@@ -27885,7 +27890,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_UNUSED_T
        call_info = ZEND_CALL_NESTED_FUNCTION;
        if (UNEXPECTED((fbc->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                obj = NULL;
-       } else if (IS_UNUSED & (IS_VAR|IS_TMP_VAR)) {
+       } else if (IS_UNUSED & (IS_VAR|IS_TMP_VAR|IS_CV)) {
+               /* CV may be changed inderectly (e.g. when it's a reference) */
                call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_RELEASE_THIS;
                GC_REFCOUNT(obj)++; /* For $this pointer */
        }
@@ -32184,7 +32190,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CV_CONST
        call_info = ZEND_CALL_NESTED_FUNCTION;
        if (UNEXPECTED((fbc->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                obj = NULL;
-       } else if (IS_CV & (IS_VAR|IS_TMP_VAR)) {
+       } else if (IS_CV & (IS_VAR|IS_TMP_VAR|IS_CV)) {
+               /* CV may be changed inderectly (e.g. when it's a reference) */
                call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_RELEASE_THIS;
                GC_REFCOUNT(obj)++; /* For $this pointer */
        }
@@ -37265,7 +37272,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CV_CV_HA
        call_info = ZEND_CALL_NESTED_FUNCTION;
        if (UNEXPECTED((fbc->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                obj = NULL;
-       } else if (IS_CV & (IS_VAR|IS_TMP_VAR)) {
+       } else if (IS_CV & (IS_VAR|IS_TMP_VAR|IS_CV)) {
+               /* CV may be changed inderectly (e.g. when it's a reference) */
                call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_RELEASE_THIS;
                GC_REFCOUNT(obj)++; /* For $this pointer */
        }
@@ -39845,7 +39853,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CV_TMPVA
        call_info = ZEND_CALL_NESTED_FUNCTION;
        if (UNEXPECTED((fbc->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                obj = NULL;
-       } else if (IS_CV & (IS_VAR|IS_TMP_VAR)) {
+       } else if (IS_CV & (IS_VAR|IS_TMP_VAR|IS_CV)) {
+               /* CV may be changed inderectly (e.g. when it's a reference) */
                call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_RELEASE_THIS;
                GC_REFCOUNT(obj)++; /* For $this pointer */
        }
@@ -41997,7 +42006,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_TMPVAR_C
        call_info = ZEND_CALL_NESTED_FUNCTION;
        if (UNEXPECTED((fbc->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                obj = NULL;
-       } else if ((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) {
+       } else if ((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR|IS_CV)) {
+               /* CV may be changed inderectly (e.g. when it's a reference) */
                call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_RELEASE_THIS;
                GC_REFCOUNT(obj)++; /* For $this pointer */
        }
@@ -44066,7 +44076,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_TMPVAR_C
        call_info = ZEND_CALL_NESTED_FUNCTION;
        if (UNEXPECTED((fbc->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                obj = NULL;
-       } else if ((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) {
+       } else if ((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR|IS_CV)) {
+               /* CV may be changed inderectly (e.g. when it's a reference) */
                call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_RELEASE_THIS;
                GC_REFCOUNT(obj)++; /* For $this pointer */
        }
@@ -45123,7 +45134,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_TMPVAR_T
        call_info = ZEND_CALL_NESTED_FUNCTION;
        if (UNEXPECTED((fbc->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                obj = NULL;
-       } else if ((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) {
+       } else if ((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR|IS_CV)) {
+               /* CV may be changed inderectly (e.g. when it's a reference) */
                call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_RELEASE_THIS;
                GC_REFCOUNT(obj)++; /* For $this pointer */
        }