Fixed bug in ZEND_POST_INC/ZEND_POST_DEC handlers.

These opcodes assume IS_TMP_VAR as result.

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index ad6c7e4774a904261130676caf3229802bdcd002..a8269eafa746792b6deae170417f96d44c664dda 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -772,9 +772,7 @@ ZEND_VM_HANDLER(36, ZEND_POST_INC, VAR|CV, ANY)
        }
        if (*var_ptr == EG(error_zval_ptr)) {
                if (!RETURN_VALUE_UNUSED(&opline->result)) {
-                       EX_T(opline->result.u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr);
-                       PZVAL_LOCK(*EX_T(opline->result.u.var).var.ptr_ptr);
-                       AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       EX_T(opline->result.u.var).tmp_var = *EG(uninitialized_zval_ptr);
                }
                FREE_OP1_VAR_PTR();
                ZEND_VM_NEXT_OPCODE();
@@ -812,9 +810,7 @@ ZEND_VM_HANDLER(37, ZEND_POST_DEC, VAR|CV, ANY)
        }
        if (*var_ptr == EG(error_zval_ptr)) {
                if (!RETURN_VALUE_UNUSED(&opline->result)) {
-                       EX_T(opline->result.u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr);
-                       PZVAL_LOCK(*EX_T(opline->result.u.var).var.ptr_ptr);
-                       AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       EX_T(opline->result.u.var).tmp_var = *EG(uninitialized_zval_ptr);
                }
                FREE_OP1_VAR_PTR();
                ZEND_VM_NEXT_OPCODE();

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index ab53117ca756e23bd2d98dae125375a32d28b8d2..75aa2edaefb517cf29a560d0dc71f91762ddbf7f 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -6601,9 +6601,7 @@ static int ZEND_POST_INC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
        if (*var_ptr == EG(error_zval_ptr)) {
                if (!RETURN_VALUE_UNUSED(&opline->result)) {
-                       EX_T(opline->result.u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr);
-                       PZVAL_LOCK(*EX_T(opline->result.u.var).var.ptr_ptr);
-                       AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       EX_T(opline->result.u.var).tmp_var = *EG(uninitialized_zval_ptr);
                }
                if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
                ZEND_VM_NEXT_OPCODE();
@@ -6641,9 +6639,7 @@ static int ZEND_POST_DEC_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
        if (*var_ptr == EG(error_zval_ptr)) {
                if (!RETURN_VALUE_UNUSED(&opline->result)) {
-                       EX_T(opline->result.u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr);
-                       PZVAL_LOCK(*EX_T(opline->result.u.var).var.ptr_ptr);
-                       AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       EX_T(opline->result.u.var).tmp_var = *EG(uninitialized_zval_ptr);
                }
                if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
                ZEND_VM_NEXT_OPCODE();
@@ -17386,9 +17382,7 @@ static int ZEND_POST_INC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
        if (*var_ptr == EG(error_zval_ptr)) {
                if (!RETURN_VALUE_UNUSED(&opline->result)) {
-                       EX_T(opline->result.u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr);
-                       PZVAL_LOCK(*EX_T(opline->result.u.var).var.ptr_ptr);
-                       AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       EX_T(opline->result.u.var).tmp_var = *EG(uninitialized_zval_ptr);
                }
                ;
                ZEND_VM_NEXT_OPCODE();
@@ -17426,9 +17420,7 @@ static int ZEND_POST_DEC_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
        if (*var_ptr == EG(error_zval_ptr)) {
                if (!RETURN_VALUE_UNUSED(&opline->result)) {
-                       EX_T(opline->result.u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr);
-                       PZVAL_LOCK(*EX_T(opline->result.u.var).var.ptr_ptr);
-                       AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       EX_T(opline->result.u.var).tmp_var = *EG(uninitialized_zval_ptr);
                }
                ;
                ZEND_VM_NEXT_OPCODE();
@@ -28487,9 +28479,7 @@ static int ZEND_POST_INC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
        if (*var_ptr == EG(error_zval_ptr)) {
                if (!RETURN_VALUE_UNUSED(&opline->result)) {
-                       EX_T(opline->result.u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr);
-                       PZVAL_LOCK(*EX_T(opline->result.u.var).var.ptr_ptr);
-                       AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       EX_T(opline->result.u.var).tmp_var = *EG(uninitialized_zval_ptr);
                }
                if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
                ZEND_VM_NEXT_OPCODE();
@@ -28527,9 +28517,7 @@ static int ZEND_POST_DEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
        }
        if (*var_ptr == EG(error_zval_ptr)) {
                if (!RETURN_VALUE_UNUSED(&opline->result)) {
-                       EX_T(opline->result.u.var).var.ptr_ptr = &EG(uninitialized_zval_ptr);
-                       PZVAL_LOCK(*EX_T(opline->result.u.var).var.ptr_ptr);
-                       AI_USE_PTR(EX_T(opline->result.u.var).var);
+                       EX_T(opline->result.u.var).tmp_var = *EG(uninitialized_zval_ptr);
                }
                if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
                ZEND_VM_NEXT_OPCODE();