Deref names returned by __sleep()

diff --git a/ext/standard/tests/serialize/sleep_deref.phpt b/ext/standard/tests/serialize/sleep_deref.phpt
new file mode 100644 (file)
index 0000000..36777db
--- /dev/null
+++ b/ext/standard/tests/serialize/sleep_deref.phpt
@@ -0,0 +1,18 @@
+--TEST--
+__sleep() can return references
+--FILE--
+<?php
+
+class Test {
+    public $x = 42;
+    public function __sleep() {
+        $name = 'x';
+        return [&$name];
+    }
+}
+
+var_dump(serialize(new Test));
+
+?>
+--EXPECT--
+string(28) "O:4:"Test":1:{s:1:"x";i:42;}"

diff --git a/ext/standard/var.c b/ext/standard/var.c
index a2eb471d5459abdb0446254b407e0ce75f5a2d27..aafc35e8bf5128167a10c4ef33488d9840e70102 100644 (file)
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -778,6 +778,7 @@ static void php_var_serialize_collect_names(HashTable *ht, HashTable *src) /* {{
 
        zend_hash_init(ht, zend_hash_num_elements(src), NULL, NULL, 0);
        ZEND_HASH_FOREACH_VAL(src, val) {
+               ZVAL_DEREF(val);
                if (Z_TYPE_P(val) != IS_STRING) {
                        php_error_docref(NULL, E_NOTICE,
                                        "__sleep should return an array only containing the names of instance-variables to serialize.");