EG(error_zval) must be passed as IS_INDIRECT

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 807d9aee6214679fb0aed7933029d54655020ad8..db08f3c74298cbf11e3dc23cbaa0b6ecb3e7cea7 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -569,7 +569,7 @@ static zend_always_inline zval *_get_zval_ptr_ptr_var(zend_uint var, const zend_
 {
        zval *ret = EX_VAR(var);
 
-       if (UNEXPECTED(Z_TYPE_P(ret) == IS_INDIRECT)) {
+       if (EXPECTED(Z_TYPE_P(ret) == IS_INDIRECT)) {
                ret = Z_INDIRECT_P(ret);
        } else if (!Z_REFCOUNTED_P(ret)) {
                should_free->var = ret;
@@ -1187,7 +1187,7 @@ fetch_from_array:
 
                case IS_NULL:
                        if (container == &EG(error_zval)) {
-                               result = &EG(error_zval);
+                               ZVAL_INDIRECT(result, &EG(error_zval));
                        } else if (type != BP_VAR_UNSET) {
 convert_to_array:
                                if (Z_TYPE_P(container_ptr) != IS_REFERENCE) {
@@ -1293,7 +1293,7 @@ convert_to_array:
                                                ZVAL_INDIRECT(result, overloaded_result);
                                        }
                                } else {
-                                       result = &EG(error_zval);
+                                       ZVAL_INDIRECT(result, &EG(error_zval));
                                }
 //???                          if (dim_type == IS_TMP_VAR) {
 //???                                  zval_ptr_dtor(dim);
@@ -1314,7 +1314,7 @@ convert_to_array:
                                ZVAL_NULL(result);
                        } else {
                                zend_error(E_WARNING, "Cannot use a scalar value as an array");
-                               ZVAL_NULL(result);
+                               ZVAL_INDIRECT(result, &EG(error_zval));
                        }
                        break;
        }

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 9d88b697c83c0b0a0215b4417b7d1c763aae2b26..8c272a5494fae63b1b9d246d5f7056dfa2e2d4a1 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1790,9 +1790,9 @@ ZEND_VM_HANDLER(39, ZEND_ASSIGN_REF, VAR|CV, VAR|CV)
        } else if (OP2_TYPE == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
                PZVAL_LOCK(value_ptr);
        }
-//???  if (OP1_TYPE == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
-//???          zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
-//???  }
+       if (OP1_TYPE == IS_VAR && UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT)) {
+               zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
+       }
 
        variable_ptr = GET_OP1_ZVAL_PTR_PTR(BP_VAR_W);
        if ((OP2_TYPE == IS_VAR && UNEXPECTED(Z_TYPE_P(value_ptr) == IS_STR_OFFSET)) ||

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index d20433a6e2c0f5a71155002a9c85bad693d6afc6..a1779caf7747bcbae3a48f69e043fe40f713c251 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -19566,9 +19566,9 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDL
        } else if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
                PZVAL_LOCK(value_ptr);
        }
-//???  if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
-//???          zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
-//???  }
+       if (IS_VAR == IS_VAR && UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT)) {
+               zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
+       }
 
        variable_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
        if ((IS_VAR == IS_VAR && UNEXPECTED(Z_TYPE_P(value_ptr) == IS_STR_OFFSET)) ||
@@ -22926,9 +22926,9 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLE
        } else if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
                PZVAL_LOCK(value_ptr);
        }
-//???  if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
-//???          zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
-//???  }
+       if (IS_VAR == IS_VAR && UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT)) {
+               zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
+       }
 
        variable_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
        if ((IS_CV == IS_VAR && UNEXPECTED(Z_TYPE_P(value_ptr) == IS_STR_OFFSET)) ||
@@ -36191,9 +36191,9 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLE
        } else if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
                PZVAL_LOCK(value_ptr);
        }
-//???  if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
-//???          zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
-//???  }
+       if (IS_CV == IS_VAR && UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT)) {
+               zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
+       }
 
        variable_ptr = _get_zval_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
        if ((IS_VAR == IS_VAR && UNEXPECTED(Z_TYPE_P(value_ptr) == IS_STR_OFFSET)) ||
@@ -39291,9 +39291,9 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER
        } else if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
                PZVAL_LOCK(value_ptr);
        }
-//???  if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
-//???          zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
-//???  }
+       if (IS_CV == IS_VAR && UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT)) {
+               zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
+       }
 
        variable_ptr = _get_zval_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
        if ((IS_CV == IS_VAR && UNEXPECTED(Z_TYPE_P(value_ptr) == IS_STR_OFFSET)) ||