Fixed bug #43201 (Crash on using unitialized vals and __get/__set)

diff --git a/Zend/tests/bug43201.phpt b/Zend/tests/bug43201.phpt
new file mode 100755 (executable)
index 0000000..89e1b66
--- /dev/null
+++ b/Zend/tests/bug43201.phpt
@@ -0,0 +1,54 @@
+--TEST--
+Bug #43201 (Crash on using unitialized vals and __get/__set)
+--FILE--
+<?php
+class Foo {
+       function __get($k) {
+               return null;
+       }
+       function __set($k, $v) {
+               $this->$k = $v;
+       }
+}
+
+$c = new Foo();
+
+$c->arr[0]["k"] = 1;
+$c->arr[0]["k2"] = $ref;
+for($cnt=0;$cnt<6;$cnt++) {
+       $ref = chop($undef);    
+       $c->arr[$cnt]["k2"] = $ref;
+}
+echo "ok\n";
+?>
+--EXPECTF--
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 13
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 14
+
+Notice: Undefined variable: ref in %sbug43201.php on line 14
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+
+Notice: Undefined variable: undef in %sbug43201.php on line 16
+
+Notice: Indirect modification of overloaded property Foo::$arr has no effect in %sbug43201.php on line 17
+ok

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 5956bf90efdc6ece71e7625b204f29f7bc54efa0..ddc059deb31a922853549256d3589ad4e7100230 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1103,6 +1103,10 @@ ZEND_VM_HANDLER(84, ZEND_FETCH_DIM_W, VAR|CV, CONST|TMP|VAR|UNUSED|CV)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        FREE_OP1_VAR_PTR();
        
@@ -1128,6 +1132,10 @@ ZEND_VM_HANDLER(87, ZEND_FETCH_DIM_RW, VAR|CV, CONST|TMP|VAR|UNUSED|CV)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        FREE_OP1_VAR_PTR();
        ZEND_VM_NEXT_OPCODE();
@@ -1162,6 +1170,10 @@ ZEND_VM_HANDLER(93, ZEND_FETCH_DIM_FUNC_ARG, VAR|CV, CONST|TMP|VAR|UNUSED|CV)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        FREE_OP1_VAR_PTR();
        ZEND_VM_NEXT_OPCODE();
@@ -1190,6 +1202,10 @@ ZEND_VM_HANDLER(96, ZEND_FETCH_DIM_UNSET, VAR|CV, CONST|TMP|VAR|CV)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        FREE_OP1_VAR_PTR();
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -1296,6 +1312,10 @@ ZEND_VM_HANDLER(85, ZEND_FETCH_OBJ_W, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        FREE_OP1_VAR_PTR();
 
@@ -1328,6 +1348,10 @@ ZEND_VM_HANDLER(88, ZEND_FETCH_OBJ_RW, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        FREE_OP1_VAR_PTR();
        ZEND_VM_NEXT_OPCODE();
@@ -1360,6 +1384,10 @@ ZEND_VM_HANDLER(94, ZEND_FETCH_OBJ_FUNC_ARG, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
                FREE_OP1_VAR_PTR();
                ZEND_VM_NEXT_OPCODE();
@@ -1393,6 +1421,10 @@ ZEND_VM_HANDLER(97, ZEND_FETCH_OBJ_UNSET, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        FREE_OP1_VAR_PTR();
 

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 5d1d7af5b7c05c36dd6d6e87d990b2a61a79dbc8..15edae4b4a55b18d54e30982a03b43d706ee993d 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -9659,6 +9659,10 @@ static int ZEND_FETCH_DIM_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
 
@@ -9684,6 +9688,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -9718,6 +9726,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_AR
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -9746,6 +9758,10 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -9852,6 +9868,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
 
@@ -9884,6 +9904,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -9916,6 +9940,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_AR
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
                if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
                ZEND_VM_NEXT_OPCODE();
@@ -9949,6 +9977,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
 
@@ -11403,6 +11435,10 @@ static int ZEND_FETCH_DIM_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
 
@@ -11428,6 +11464,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -11462,6 +11502,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -11490,6 +11534,10 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -11596,6 +11644,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
 
@@ -11628,6 +11680,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -11660,6 +11716,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
                if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
                ZEND_VM_NEXT_OPCODE();
@@ -11693,6 +11753,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
 
@@ -13056,6 +13120,10 @@ static int ZEND_FETCH_DIM_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
 
@@ -13081,6 +13149,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -13115,6 +13187,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -13143,6 +13219,10 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -13249,6 +13329,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
 
@@ -13281,6 +13365,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -13313,6 +13401,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
                if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
                ZEND_VM_NEXT_OPCODE();
@@ -13346,6 +13438,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
 
@@ -14309,6 +14405,10 @@ static int ZEND_FETCH_DIM_W_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
 
@@ -14334,6 +14434,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -14356,6 +14460,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_A
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -15280,6 +15388,10 @@ static int ZEND_FETCH_DIM_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
 
@@ -15305,6 +15417,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -15339,6 +15455,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -15367,6 +15487,10 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -15473,6 +15597,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
 
@@ -15505,6 +15633,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
        ZEND_VM_NEXT_OPCODE();
@@ -15537,6 +15669,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
                if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
                ZEND_VM_NEXT_OPCODE();
@@ -15570,6 +15706,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
        if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
 
@@ -16867,6 +17007,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        /* We are going to assign the result by reference */
@@ -16898,6 +17042,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -16930,6 +17078,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
 
                ZEND_VM_NEXT_OPCODE();
@@ -16963,6 +17115,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_AR
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        PZVAL_UNLOCK(*EX_T(opline->result.u.var).var.ptr_ptr, &free_res);
@@ -17959,6 +18115,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        /* We are going to assign the result by reference */
@@ -17990,6 +18150,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -18022,6 +18186,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_A
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
 
                ZEND_VM_NEXT_OPCODE();
@@ -18055,6 +18223,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        PZVAL_UNLOCK(*EX_T(opline->result.u.var).var.ptr_ptr, &free_res);
@@ -18985,6 +19157,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        /* We are going to assign the result by reference */
@@ -19016,6 +19192,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -19048,6 +19228,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_A
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
 
                ZEND_VM_NEXT_OPCODE();
@@ -19081,6 +19265,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        PZVAL_UNLOCK(*EX_T(opline->result.u.var).var.ptr_ptr, &free_res);
@@ -20276,6 +20464,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        /* We are going to assign the result by reference */
@@ -20307,6 +20499,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -20339,6 +20535,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_AR
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
 
                ZEND_VM_NEXT_OPCODE();
@@ -20372,6 +20572,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        PZVAL_UNLOCK(*EX_T(opline->result.u.var).var.ptr_ptr, &free_res);
@@ -22819,6 +23023,10 @@ static int ZEND_FETCH_DIM_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        /* We are going to assign the result by reference */
@@ -22843,6 +23051,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -22877,6 +23089,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARG
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -22905,6 +23121,10 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -23010,6 +23230,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        /* We are going to assign the result by reference */
@@ -23041,6 +23265,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -23073,6 +23301,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARG
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
 
                ZEND_VM_NEXT_OPCODE();
@@ -23106,6 +23338,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        PZVAL_UNLOCK(*EX_T(opline->result.u.var).var.ptr_ptr, &free_res);
@@ -24396,6 +24632,10 @@ static int ZEND_FETCH_DIM_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        /* We are going to assign the result by reference */
@@ -24420,6 +24660,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -24454,6 +24698,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -24482,6 +24730,10 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -24587,6 +24839,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        /* We are going to assign the result by reference */
@@ -24618,6 +24874,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -24650,6 +24910,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
 
                ZEND_VM_NEXT_OPCODE();
@@ -24683,6 +24947,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        PZVAL_UNLOCK(*EX_T(opline->result.u.var).var.ptr_ptr, &free_res);
@@ -25949,6 +26217,10 @@ static int ZEND_FETCH_DIM_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        /* We are going to assign the result by reference */
@@ -25973,6 +26245,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -26007,6 +26283,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -26035,6 +26315,10 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -26140,6 +26424,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        /* We are going to assign the result by reference */
@@ -26171,6 +26459,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -26203,6 +26495,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
 
                ZEND_VM_NEXT_OPCODE();
@@ -26236,6 +26532,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        PZVAL_UNLOCK(*EX_T(opline->result.u.var).var.ptr_ptr, &free_res);
@@ -27101,6 +27401,10 @@ static int ZEND_FETCH_DIM_W_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        /* We are going to assign the result by reference */
@@ -27125,6 +27429,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -27147,6 +27455,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_AR
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -27980,6 +28292,10 @@ static int ZEND_FETCH_DIM_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        /* We are going to assign the result by reference */
@@ -28004,6 +28320,10 @@ static int ZEND_FETCH_DIM_RW_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -28038,6 +28358,10 @@ static int ZEND_FETCH_DIM_FUNC_ARG_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -28066,6 +28390,10 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) {
@@ -28171,6 +28499,10 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        /* We are going to assign the result by reference */
@@ -28202,6 +28534,10 @@ static int ZEND_FETCH_OBJ_RW_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        ZEND_VM_NEXT_OPCODE();
@@ -28234,6 +28570,10 @@ static int ZEND_FETCH_OBJ_FUNC_ARG_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                    READY_TO_DESTROY(free_op1.var) &&
                    !RETURN_VALUE_UNUSED(&opline->result)) {
                        AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                           Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                               SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+                       }
                }
 
                ZEND_VM_NEXT_OPCODE();
@@ -28267,6 +28607,10 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
            READY_TO_DESTROY(free_op1.var) &&
            !RETURN_VALUE_UNUSED(&opline->result)) {
                AI_USE_PTR(EX_T(opline->result.u.var).var);
+               if (!PZVAL_IS_REF(*EX_T(opline->result.u.var).var.ptr_ptr) &&
+                   Z_REFCOUNT_PP(EX_T(opline->result.u.var).var.ptr_ptr) > 2) {
+                       SEPARATE_ZVAL(EX_T(opline->result.u.var).var.ptr_ptr);
+               }
        }
 
        PZVAL_UNLOCK(*EX_T(opline->result.u.var).var.ptr_ptr, &free_res);