Backport fix for bug #70083 to PHP-5.6

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 11f62053b18e4183d364540254cf634580d500a5..7bfa814275de28b269e6a94ad9da65d6ee2699dd 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1774,6 +1774,10 @@ ZEND_VM_HANDLER(39, ZEND_ASSIGN_REF, VAR|CV, VAR|CV)
        SAVE_OPLINE();
        value_ptr_ptr = GET_OP2_ZVAL_PTR_PTR(BP_VAR_W);
 
+       if (OP1_TYPE == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
+               zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
+       }
+
        if (OP2_TYPE == IS_VAR &&
            value_ptr_ptr &&
            !Z_ISREF_PP(value_ptr_ptr) &&
@@ -1791,9 +1795,6 @@ ZEND_VM_HANDLER(39, ZEND_ASSIGN_REF, VAR|CV, VAR|CV)
        } else if (OP2_TYPE == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
                PZVAL_LOCK(*value_ptr_ptr);
        }
-       if (OP1_TYPE == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
-               zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
-       }
 
        variable_ptr_ptr = GET_OP1_ZVAL_PTR_PTR(BP_VAR_W);
        if ((OP2_TYPE == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 5ed4135c5960ae9d6f67ca753ab82ea60c33d3e6..07b9abc152dc269aa3f4f7b58e4c6b1815740c1c 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -20331,6 +20331,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDL
        SAVE_OPLINE();
        value_ptr_ptr = _get_zval_ptr_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
 
+       if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
+               zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
+       }
+
        if (IS_VAR == IS_VAR &&
            value_ptr_ptr &&
            !Z_ISREF_PP(value_ptr_ptr) &&
@@ -20348,9 +20352,6 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDL
        } else if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
                PZVAL_LOCK(*value_ptr_ptr);
        }
-       if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
-               zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
-       }
 
        variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
        if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
@@ -23801,6 +23802,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLE
        SAVE_OPLINE();
        value_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op2.var TSRMLS_CC);
 
+       if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
+               zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
+       }
+
        if (IS_CV == IS_VAR &&
            value_ptr_ptr &&
            !Z_ISREF_PP(value_ptr_ptr) &&
@@ -23818,9 +23823,6 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLE
        } else if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
                PZVAL_LOCK(*value_ptr_ptr);
        }
-       if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
-               zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
-       }
 
        variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
        if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
@@ -37492,6 +37494,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLE
        SAVE_OPLINE();
        value_ptr_ptr = _get_zval_ptr_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);
 
+       if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
+               zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
+       }
+
        if (IS_VAR == IS_VAR &&
            value_ptr_ptr &&
            !Z_ISREF_PP(value_ptr_ptr) &&
@@ -37509,9 +37515,6 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLE
        } else if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
                PZVAL_LOCK(*value_ptr_ptr);
        }
-       if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
-               zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
-       }
 
        variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
        if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
@@ -40675,6 +40678,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER
        SAVE_OPLINE();
        value_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op2.var TSRMLS_CC);
 
+       if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
+               zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
+       }
+
        if (IS_CV == IS_VAR &&
            value_ptr_ptr &&
            !Z_ISREF_PP(value_ptr_ptr) &&
@@ -40692,9 +40699,6 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER
        } else if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
                PZVAL_LOCK(*value_ptr_ptr);
        }
-       if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
-               zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
-       }
 
        variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
        if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||