- Fixed bug #52773 (Proxy objects have an inadequate destroy_object store callback)

- Fixed bug #52774 (Proxy object's store free callback calls zval_ptor_dtor on already freed data)

diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c
index 3587e99dd18628b76e260efbdc66b300ad944cda..b565f6a1d10ad39a8ed6169d961e77ea17392fbe 100644 (file)
--- a/Zend/zend_objects_API.c
+++ b/Zend/zend_objects_API.c
@@ -314,6 +314,10 @@ typedef struct _zend_proxy_object {
 
 static zend_object_handlers zend_object_proxy_handlers;
 
+ZEND_API void zend_objects_proxy_destroy(zend_object *object, zend_object_handle handle TSRMLS_DC)
+{
+}
+
 ZEND_API void zend_objects_proxy_free_storage(zend_proxy_object *object TSRMLS_DC)
 {
        zval_ptr_dtor(&object->object);
@@ -336,13 +340,14 @@ ZEND_API zval *zend_object_create_proxy(zval *object, zval *member TSRMLS_DC)
        zval *retval;
 
        pobj->object = object;
-       pobj->property = member;
-       zval_add_ref(&pobj->property);
        zval_add_ref(&pobj->object);
+       ALLOC_ZVAL(pobj->property);
+       INIT_PZVAL_COPY(pobj->property, member);
+       zval_copy_ctor(pobj->property);
 
        MAKE_STD_ZVAL(retval);
        Z_TYPE_P(retval) = IS_OBJECT;
-       Z_OBJ_HANDLE_P(retval) = zend_objects_store_put(pobj, NULL, (zend_objects_free_object_storage_t) zend_objects_proxy_free_storage, (zend_objects_store_clone_t) zend_objects_proxy_clone TSRMLS_CC);
+       Z_OBJ_HANDLE_P(retval) = zend_objects_store_put(pobj, (zend_objects_store_dtor_t)zend_objects_proxy_destroy, (zend_objects_free_object_storage_t) zend_objects_proxy_free_storage, (zend_objects_store_clone_t) zend_objects_proxy_clone TSRMLS_CC);
        Z_OBJ_HT_P(retval) = &zend_object_proxy_handlers;
 
        return retval;