Fixed foreach by-ref bug.

# Patch from Brian Shire

diff --git a/Zend/tests/foreach.phpt b/Zend/tests/foreach.phpt
new file mode 100644 (file)
index 0000000..041a763
--- /dev/null
+++ b/Zend/tests/foreach.phpt
@@ -0,0 +1,25 @@
+--TEST--
+foreach() by-ref bug
+--FILE--
+<?php
+$foo = array(1,2,3,4);
+foreach($foo as $key => &$val) {
+       if($val == 3) {
+               $foo[$key] = 0;
+       } else {
+               $val++;
+       }
+}
+var_dump($foo);
+?>
+--EXPECT--     
+array(4) {
+  [0]=>
+  int(2)
+  [1]=>
+  int(3)
+  [2]=>
+  int(0)
+  [3]=>
+  &int(5)
+}

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index bad088a2d7fd500908864e1a99bb2dbccf4e6cfd..e5edf1aaf13fdf42f54260c73c471db9594e5b63 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3102,6 +3102,9 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
                } else {
                        if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
                                SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+                               if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
+                                       (*array_ptr_ptr)->is_ref = 1;
+                               }
                        }
                        array_ptr = *array_ptr_ptr;
                        array_ptr->refcount++;

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index d64f9f4ee97c25aff882892cd3d3c0225dc21368..cdbc4afe27f00a39ba3283c9e54e84ea975e30ca 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -2151,6 +2151,9 @@ static int ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                } else {
                        if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
                                SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+                               if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
+                                       (*array_ptr_ptr)->is_ref = 1;
+                               }
                        }
                        array_ptr = *array_ptr_ptr;
                        array_ptr->refcount++;
@@ -4715,6 +4718,9 @@ static int ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                } else {
                        if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
                                SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+                               if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
+                                       (*array_ptr_ptr)->is_ref = 1;
+                               }
                        }
                        array_ptr = *array_ptr_ptr;
                        array_ptr->refcount++;
@@ -7846,6 +7852,9 @@ static int ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                } else {
                        if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
                                SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+                               if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
+                                       (*array_ptr_ptr)->is_ref = 1;
+                               }
                        }
                        array_ptr = *array_ptr_ptr;
                        array_ptr->refcount++;
@@ -19907,6 +19916,9 @@ static int ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                } else {
                        if (Z_TYPE_PP(array_ptr_ptr) == IS_ARRAY) {
                                SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+                               if (opline->extended_value & ZEND_FE_FETCH_BYREF) {
+                                       (*array_ptr_ptr)->is_ref = 1;
+                               }
                        }
                        array_ptr = *array_ptr_ptr;
                        array_ptr->refcount++;