Fixed bug #33282 (Re-assignment by reference does not clear the is_ref flag)

# Original patch by Matt Wilmas

diff --git a/Zend/tests/bug33282.phpt b/Zend/tests/bug33282.phpt
new file mode 100644 (file)
index 0000000..65e3c16
--- /dev/null
+++ b/Zend/tests/bug33282.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #33282 (Re-assignment by reference does not clear the is_ref flag)
+--FILE--
+<?php
+       $a = array(1, 2, 3);
+       $r = &$a[0];
+       $r = &$a[1];
+       $r = &$a[2];
+       var_dump($a);
+?>
+--EXPECT--     
+array(3) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  &int(3)
+}

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index fbaed013b144e86d9a7a4c1fac0171ec94e7fa26..c6ab1db9b97fb932e6b3c5d788f782279d0cee62 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -411,11 +411,7 @@ static void zend_assign_to_variable_reference(zval **variable_ptr_ptr, zval **va
                *variable_ptr_ptr = value_ptr;
                value_ptr->refcount++;
 
-               variable_ptr->refcount--;
-               if (variable_ptr->refcount==0) {
-                       zendi_zval_dtor(*variable_ptr);
-                       FREE_ZVAL(variable_ptr);
-               }
+               zval_ptr_dtor(&variable_ptr);
        } else if (!variable_ptr->is_ref) {
                if (variable_ptr_ptr == value_ptr_ptr) {
                        SEPARATE_ZVAL(variable_ptr_ptr);