Fixed pass by reference special cases

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 375df48ae3d16987547b9f1ff05c304bb1322be8..c18a5a81966e419fa418b677ad6907f543b489e5 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3097,9 +3097,10 @@ ZEND_VM_HANDLER(106, ZEND_SEND_VAR_NO_REF, VAR|CV, ANY)
        varptr = GET_OP1_ZVAL_PTR(BP_VAR_R);
        if ((!(opline->extended_value & ZEND_ARG_SEND_FUNCTION) ||
             (varptr->var_flags & IS_VAR_RET_REF)) &&
-           (!Z_REFCOUNTED_P(varptr) || 
+           ((!Z_REFCOUNTED_P(varptr) && Z_TYPE_P(varptr) != IS_STRING) || 
             Z_ISREF_P(varptr) ||
-            Z_REFCOUNT_P(varptr) == 1)) {
+            Z_TYPE_P(varptr) == IS_OBJECT ||
+            (Z_REFCOUNTED_P(varptr) && Z_REFCOUNT_P(varptr) == 1))) {
 
                if (Z_ISREF_P(varptr)) {
                        if (OP1_TYPE == IS_CV) {

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index f842079ffdd1c56faa062284c05277fded924924..8bc684870defbfb616b8bcb76945449125e18e2f 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -12909,9 +12909,10 @@ static int ZEND_FASTCALL  ZEND_SEND_VAR_NO_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HAND
        varptr = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
        if ((!(opline->extended_value & ZEND_ARG_SEND_FUNCTION) ||
             (varptr->var_flags & IS_VAR_RET_REF)) &&
-           (!Z_REFCOUNTED_P(varptr) ||
+           ((!Z_REFCOUNTED_P(varptr) && Z_TYPE_P(varptr) != IS_STRING) ||
             Z_ISREF_P(varptr) ||
-            Z_REFCOUNT_P(varptr) == 1)) {
+            Z_TYPE_P(varptr) == IS_OBJECT ||
+            (Z_REFCOUNTED_P(varptr) && Z_REFCOUNT_P(varptr) == 1))) {
 
                if (Z_ISREF_P(varptr)) {
                        if (IS_VAR == IS_CV) {
@@ -30292,9 +30293,10 @@ static int ZEND_FASTCALL  ZEND_SEND_VAR_NO_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDL
        varptr = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
        if ((!(opline->extended_value & ZEND_ARG_SEND_FUNCTION) ||
             (varptr->var_flags & IS_VAR_RET_REF)) &&
-           (!Z_REFCOUNTED_P(varptr) ||
+           ((!Z_REFCOUNTED_P(varptr) && Z_TYPE_P(varptr) != IS_STRING) ||
             Z_ISREF_P(varptr) ||
-            Z_REFCOUNT_P(varptr) == 1)) {
+            Z_TYPE_P(varptr) == IS_OBJECT ||
+            (Z_REFCOUNTED_P(varptr) && Z_REFCOUNT_P(varptr) == 1))) {
 
                if (Z_ISREF_P(varptr)) {
                        if (IS_CV == IS_CV) {