Deref slow-path ASSIGN_OBJ result

We should not store a reference inside IS_TMP_VAR.

diff --git a/Zend/tests/assign_obj_ref_return.phpt b/Zend/tests/assign_obj_ref_return.phpt
new file mode 100644 (file)
index 0000000..0c21c08
--- /dev/null
+++ b/Zend/tests/assign_obj_ref_return.phpt
@@ -0,0 +1,18 @@
+--TEST--
+ASSIGN_OBJ should not return reference
+--FILE--
+<?php
+
+$obj = new stdClass;
+$obj->ref =& $ref;
+$obj->val = $obj->ref = 42;
+var_dump($obj);
+
+?>
+--EXPECT--
+object(stdClass)#1 (2) {
+  ["ref"]=>
+  &int(42)
+  ["val"]=>
+  int(42)
+}

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index a2127f80b3f1f0fef24c0c73f5d76c038d8e9967..b766bf24694fc7d3c572fc7b34f67f108141238a 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2465,7 +2465,7 @@ ZEND_VM_C_LABEL(fast_assign_obj):
 
 ZEND_VM_C_LABEL(free_and_exit_assign_obj):
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        FREE_OP_DATA();
 ZEND_VM_C_LABEL(exit_assign_obj):

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 15232d8dab676669acf945212eb396bbb4768f44..58e97b2116ca60cdb1e7f1e04e27c4877ea89e10 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -21545,7 +21545,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj:
@@ -21690,7 +21690,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -21835,7 +21835,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -21980,7 +21980,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj:
@@ -23815,7 +23815,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj:
@@ -23960,7 +23960,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -24105,7 +24105,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -24250,7 +24250,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj:
@@ -27266,7 +27266,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj:
@@ -27411,7 +27411,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -27556,7 +27556,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -27701,7 +27701,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj:
@@ -29745,7 +29745,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj:
@@ -29890,7 +29890,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -30035,7 +30035,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -30180,7 +30180,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj:
@@ -31612,7 +31612,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj:
@@ -31757,7 +31757,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -31902,7 +31902,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -32047,7 +32047,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj:
@@ -34007,7 +34007,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj:
@@ -34152,7 +34152,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -34297,7 +34297,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -34442,7 +34442,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj:
@@ -38256,7 +38256,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj:
@@ -38401,7 +38401,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -38546,7 +38546,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -38691,7 +38691,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj:
@@ -41734,7 +41734,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj:
@@ -41879,7 +41879,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -42024,7 +42024,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -42169,7 +42169,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj:
@@ -46542,7 +46542,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj:
@@ -46687,7 +46687,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -46832,7 +46832,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
        zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
 exit_assign_obj:
@@ -46977,7 +46977,7 @@ fast_assign_obj:
 
 free_and_exit_assign_obj:
        if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
-               ZVAL_COPY(EX_VAR(opline->result.var), value);
+               ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
        }
 
 exit_assign_obj: