Fix incdec of ref object properties

This fixes a number of infinite loops in the Symfony testsuite. It
took an obscene amount of time to track this down :/

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 2ab70e8fa1260319e1d34f8695eacae6d95b15de..163a4930602c509872199c73b2e464dcab75d82d 100644 (file)
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -2086,6 +2086,7 @@ static void increment_string(zval *str) /* {{{ */
 
 ZEND_API int increment_function(zval *op1) /* {{{ */
 {
+try_again:
        switch (Z_TYPE_P(op1)) {
                case IS_LONG:
                        if (Z_LVAL_P(op1) == LONG_MAX) {
@@ -2141,6 +2142,9 @@ ZEND_API int increment_function(zval *op1) /* {{{ */
                                return res;
                        }
                        return FAILURE;
+               case IS_REFERENCE:
+                       op1 = Z_REFVAL_P(op1);
+                       goto try_again;
                default:
                        return FAILURE;
        }
@@ -2153,6 +2157,7 @@ ZEND_API int decrement_function(zval *op1) /* {{{ */
        long lval;
        double dval;
 
+try_again:
        switch (Z_TYPE_P(op1)) {
                case IS_LONG:
                        if (Z_LVAL_P(op1) == LONG_MIN) {
@@ -2200,6 +2205,9 @@ ZEND_API int decrement_function(zval *op1) /* {{{ */
                                return res;
                        }
                        return FAILURE;
+               case IS_REFERENCE:
+                       op1 = Z_REFVAL_P(op1);
+                       goto try_again;
                default:
                        return FAILURE;
        }