Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string)

diff --git a/Zend/tests/bug42772.phpt b/Zend/tests/bug42772.phpt
new file mode 100755 (executable)
index 0000000..8887bdb
--- /dev/null
+++ b/Zend/tests/bug42772.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #42772 (Storing $this in a static var fails while handling a cast to string)
+--FILE--
+<?php
+class Foo {
+    static public $foo;
+    function __toString() {
+        self::$foo = $this;
+        return 'foo';
+    }
+}
+
+$foo = (string)new Foo();
+var_dump(Foo::$foo);
+?>
+--EXPECT--
+object(Foo)#1 (0) {
+}

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index b5f7d079796ef7c0297c78acf64d0ba67194282a..d3432aee791837634364b11e2a388f38cdcaafd5 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2876,9 +2876,12 @@ ZEND_VM_HANDLER(21, ZEND_CAST, CONST|TMP|VAR|CV, ANY)
        zval *expr = GET_OP1_ZVAL_PTR(BP_VAR_R);
        zval *result = &EX_T(opline->result.u.var).tmp_var;
 
-       *result = *expr;
-       if (!IS_OP1_TMP_FREE()) {
-               zendi_zval_copy_ctor(*result);
+       if (opline->extended_value != IS_STRING &&
+           opline->extended_value != IS_UNICODE) {
+               *result = *expr;
+               if (!IS_OP1_TMP_FREE()) {
+                       zendi_zval_copy_ctor(*result);
+               }
        }
        switch (opline->extended_value) {
                case IS_NULL:
@@ -2897,10 +2900,17 @@ ZEND_VM_HANDLER(21, ZEND_CAST, CONST|TMP|VAR|CV, ANY)
                        zval var_copy;
                        int use_copy;
 
-                       zend_make_string_zval(result, &var_copy, &use_copy);
+                       zend_make_string_zval(expr, &var_copy, &use_copy);
                        if (use_copy) {
-                               zval_dtor(result);
                                *result = var_copy;
+                               if (IS_OP1_TMP_FREE()) {
+                                       FREE_OP1();
+                               }
+                       } else {
+                               *result = *expr;
+                               if (!IS_OP1_TMP_FREE()) {
+                                       zendi_zval_copy_ctor(*result);
+                               }
                        }
                        break;
                }
@@ -2908,10 +2918,17 @@ ZEND_VM_HANDLER(21, ZEND_CAST, CONST|TMP|VAR|CV, ANY)
                        zval var_copy;
                        int use_copy;
 
-                       zend_make_unicode_zval(result, &var_copy, &use_copy);
+                       zend_make_unicode_zval(expr, &var_copy, &use_copy);
                        if (use_copy) {
-                               zval_dtor(result);
                                *result = var_copy;
+                               if (IS_OP1_TMP_FREE()) {
+                                       FREE_OP1();
+                               }
+                       } else {
+                               *result = *expr;
+                               if (!IS_OP1_TMP_FREE()) {
+                                       zendi_zval_copy_ctor(*result);
+                               }
                        }
                        break;
                }

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 1410050239a2f64db06bb19d23a51f3b2a5a4618..c7b80494afeec2b66aae096e392c2a07cb88b08f 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -1705,9 +1705,12 @@ static int ZEND_CAST_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zval *expr = &opline->op1.u.constant;
        zval *result = &EX_T(opline->result.u.var).tmp_var;
 
-       *result = *expr;
-       if (!0) {
-               zendi_zval_copy_ctor(*result);
+       if (opline->extended_value != IS_STRING &&
+           opline->extended_value != IS_UNICODE) {
+               *result = *expr;
+               if (!0) {
+                       zendi_zval_copy_ctor(*result);
+               }
        }
        switch (opline->extended_value) {
                case IS_NULL:
@@ -1726,10 +1729,17 @@ static int ZEND_CAST_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        zval var_copy;
                        int use_copy;
 
-                       zend_make_string_zval(result, &var_copy, &use_copy);
+                       zend_make_string_zval(expr, &var_copy, &use_copy);
                        if (use_copy) {
-                               zval_dtor(result);
                                *result = var_copy;
+                               if (0) {
+
+                               }
+                       } else {
+                               *result = *expr;
+                               if (!0) {
+                                       zendi_zval_copy_ctor(*result);
+                               }
                        }
                        break;
                }
@@ -1737,10 +1747,17 @@ static int ZEND_CAST_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        zval var_copy;
                        int use_copy;
 
-                       zend_make_unicode_zval(result, &var_copy, &use_copy);
+                       zend_make_unicode_zval(expr, &var_copy, &use_copy);
                        if (use_copy) {
-                               zval_dtor(result);
                                *result = var_copy;
+                               if (0) {
+
+                               }
+                       } else {
+                               *result = *expr;
+                               if (!0) {
+                                       zendi_zval_copy_ctor(*result);
+                               }
                        }
                        break;
                }
@@ -4893,9 +4910,12 @@ static int ZEND_CAST_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zval *expr = _get_zval_ptr_tmp(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC);
        zval *result = &EX_T(opline->result.u.var).tmp_var;
 
-       *result = *expr;
-       if (!1) {
-               zendi_zval_copy_ctor(*result);
+       if (opline->extended_value != IS_STRING &&
+           opline->extended_value != IS_UNICODE) {
+               *result = *expr;
+               if (!1) {
+                       zendi_zval_copy_ctor(*result);
+               }
        }
        switch (opline->extended_value) {
                case IS_NULL:
@@ -4914,10 +4934,17 @@ static int ZEND_CAST_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        zval var_copy;
                        int use_copy;
 
-                       zend_make_string_zval(result, &var_copy, &use_copy);
+                       zend_make_string_zval(expr, &var_copy, &use_copy);
                        if (use_copy) {
-                               zval_dtor(result);
                                *result = var_copy;
+                               if (1) {
+                                       zval_dtor(free_op1.var);
+                               }
+                       } else {
+                               *result = *expr;
+                               if (!1) {
+                                       zendi_zval_copy_ctor(*result);
+                               }
                        }
                        break;
                }
@@ -4925,10 +4952,17 @@ static int ZEND_CAST_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        zval var_copy;
                        int use_copy;
 
-                       zend_make_unicode_zval(result, &var_copy, &use_copy);
+                       zend_make_unicode_zval(expr, &var_copy, &use_copy);
                        if (use_copy) {
-                               zval_dtor(result);
                                *result = var_copy;
+                               if (1) {
+                                       zval_dtor(free_op1.var);
+                               }
+                       } else {
+                               *result = *expr;
+                               if (!1) {
+                                       zendi_zval_copy_ctor(*result);
+                               }
                        }
                        break;
                }
@@ -8169,9 +8203,12 @@ static int ZEND_CAST_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zval *expr = _get_zval_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC);
        zval *result = &EX_T(opline->result.u.var).tmp_var;
 
-       *result = *expr;
-       if (!0) {
-               zendi_zval_copy_ctor(*result);
+       if (opline->extended_value != IS_STRING &&
+           opline->extended_value != IS_UNICODE) {
+               *result = *expr;
+               if (!0) {
+                       zendi_zval_copy_ctor(*result);
+               }
        }
        switch (opline->extended_value) {
                case IS_NULL:
@@ -8190,10 +8227,17 @@ static int ZEND_CAST_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        zval var_copy;
                        int use_copy;
 
-                       zend_make_string_zval(result, &var_copy, &use_copy);
+                       zend_make_string_zval(expr, &var_copy, &use_copy);
                        if (use_copy) {
-                               zval_dtor(result);
                                *result = var_copy;
+                               if (0) {
+                                       if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+                               }
+                       } else {
+                               *result = *expr;
+                               if (!0) {
+                                       zendi_zval_copy_ctor(*result);
+                               }
                        }
                        break;
                }
@@ -8201,10 +8245,17 @@ static int ZEND_CAST_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        zval var_copy;
                        int use_copy;
 
-                       zend_make_unicode_zval(result, &var_copy, &use_copy);
+                       zend_make_unicode_zval(expr, &var_copy, &use_copy);
                        if (use_copy) {
-                               zval_dtor(result);
                                *result = var_copy;
+                               if (0) {
+                                       if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+                               }
+                       } else {
+                               *result = *expr;
+                               if (!0) {
+                                       zendi_zval_copy_ctor(*result);
+                               }
                        }
                        break;
                }
@@ -21369,9 +21420,12 @@ static int ZEND_CAST_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        zval *expr = _get_zval_ptr_cv(&opline->op1, EX(Ts), BP_VAR_R TSRMLS_CC);
        zval *result = &EX_T(opline->result.u.var).tmp_var;
 
-       *result = *expr;
-       if (!0) {
-               zendi_zval_copy_ctor(*result);
+       if (opline->extended_value != IS_STRING &&
+           opline->extended_value != IS_UNICODE) {
+               *result = *expr;
+               if (!0) {
+                       zendi_zval_copy_ctor(*result);
+               }
        }
        switch (opline->extended_value) {
                case IS_NULL:
@@ -21390,10 +21444,17 @@ static int ZEND_CAST_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        zval var_copy;
                        int use_copy;
 
-                       zend_make_string_zval(result, &var_copy, &use_copy);
+                       zend_make_string_zval(expr, &var_copy, &use_copy);
                        if (use_copy) {
-                               zval_dtor(result);
                                *result = var_copy;
+                               if (0) {
+
+                               }
+                       } else {
+                               *result = *expr;
+                               if (!0) {
+                                       zendi_zval_copy_ctor(*result);
+                               }
                        }
                        break;
                }
@@ -21401,10 +21462,17 @@ static int ZEND_CAST_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                        zval var_copy;
                        int use_copy;
 
-                       zend_make_unicode_zval(result, &var_copy, &use_copy);
+                       zend_make_unicode_zval(expr, &var_copy, &use_copy);
                        if (use_copy) {
-                               zval_dtor(result);
                                *result = var_copy;
+                               if (0) {
+
+                               }
+                       } else {
+                               *result = *expr;
+                               if (!0) {
+                                       zendi_zval_copy_ctor(*result);
+                               }
                        }
                        break;
                }