MF51: fix #36611 (assignment to SimpleXML object attribute changes argument type...

diff --git a/ext/simplexml/simplexml.c b/ext/simplexml/simplexml.c
index 3b23eee7fa70d8556cd846c2e7526d799e95c161..56cd5ddadc5ec41dfbdddff5dc6c934ba353bd7e 100644 (file)
--- a/ext/simplexml/simplexml.c
+++ b/ext/simplexml/simplexml.c
@@ -409,7 +409,7 @@ static void sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_boo
        int                             nodendx = 0;
        int             test = 0;
        long            cnt;
-       zval            tmp_zv, trim_zv;
+       zval            tmp_zv, trim_zv, value_copy;
 
        if (!member) {
                /* This happens when the user did: $sxe[] = $value
@@ -477,6 +477,11 @@ static void sxe_prop_dim_write(zval *object, zval *member, zval *value, zend_boo
                        case IS_DOUBLE:
                        case IS_NULL:
                        case IS_UNICODE:
+                               if (value->refcount > 1) {
+                                       value_copy = *value;
+                                       zval_copy_ctor(&value_copy);
+                                       value = &value_copy;
+                               }
                                convert_to_string(value);
                                break;
                        case IS_STRING:
@@ -568,6 +573,9 @@ next_iter:
        if (pnewnode) {
                *pnewnode = newnode;
        }
+       if (value && value == &value_copy) {
+               zval_dtor(value);
+       }
 }
 /* }}} */