Fix array/object cast of refcounted tmp var

diff --git a/Zend/tests/double_array_cast.phpt b/Zend/tests/double_array_cast.phpt
new file mode 100644 (file)
index 0000000..aaee8cd
--- /dev/null
+++ b/Zend/tests/double_array_cast.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Double array cast
+--FILE--
+<?php
+
+$array = [1, 2, $x = 3];
+var_dump((array) (array) $array);
+
+?>
+--EXPECT--
+array(3) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+}

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 983029f35942d261b32dba8386daf9fd0a2ecc88..a98e82d83a905a2bd2f6788b1503a35c76d79752 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -4043,7 +4043,7 @@ ZEND_VM_HANDLER(21, ZEND_CAST, CONST|TMP|VAR|CV, ANY)
                                        if (Z_OPT_REFCOUNTED_P(expr)) Z_ADDREF_P(expr);
                                }
 
-                               FREE_OP1();
+                               FREE_OP1_IF_VAR();
                                CHECK_EXCEPTION();
                                ZEND_VM_NEXT_OPCODE();
                        }

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index e18c7303be3008459be0095bae2b33afbc67e075..2acd9f98c19e7ed8e4eb461428738fbd4f14e10d 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -9695,7 +9695,6 @@ static int ZEND_FASTCALL  ZEND_CAST_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                                        if (Z_OPT_REFCOUNTED_P(expr)) Z_ADDREF_P(expr);
                                }
 
-                               zval_ptr_dtor_nogc(free_op1.var);
                                CHECK_EXCEPTION();
                                ZEND_VM_NEXT_OPCODE();
                        }