From: Dmitry Stogov <dmitry@zend.com>
Date: Tue, 19 Aug 2014 20:00:59 +0000 (+0400)
Subject: Fixed referenced value separation
X-Git-Tag: PRE_64BIT_BRANCH_MERGE~32^2~2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=14439b79b474317f4c5c90bbca551ec3a1a5c505;p=php

Fixed referenced value separation
---

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 7749197a74..34e317c9c0 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -4547,7 +4547,10 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
 					ZVAL_UNREF(array_ref);
 					array_ptr = array_ref;
 				}
-				if (Z_IMMUTABLE_P(array_ptr)) {
+				if (Z_IMMUTABLE_P(array_ptr) ||
+				    (Z_ISREF_P(array_ref) &&
+				     Z_REFCOUNTED_P(array_ptr) &&
+				     Z_REFCOUNT_P(array_ptr) > 1)) {
 					zval_copy_ctor(array_ptr);
 				}
 				Z_ADDREF_P(array_ref);
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index c2e59c1441..ad879ed777 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -3161,7 +3161,10 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_A
 					ZVAL_UNREF(array_ref);
 					array_ptr = array_ref;
 				}
-				if (Z_IMMUTABLE_P(array_ptr)) {
+				if (Z_IMMUTABLE_P(array_ptr) ||
+				    (Z_ISREF_P(array_ref) &&
+				     Z_REFCOUNTED_P(array_ptr) &&
+				     Z_REFCOUNT_P(array_ptr) > 1)) {
 					zval_copy_ctor(array_ptr);
 				}
 				Z_ADDREF_P(array_ref);
@@ -8678,7 +8681,10 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARG
 					ZVAL_UNREF(array_ref);
 					array_ptr = array_ref;
 				}
-				if (Z_IMMUTABLE_P(array_ptr)) {
+				if (Z_IMMUTABLE_P(array_ptr) ||
+				    (Z_ISREF_P(array_ref) &&
+				     Z_REFCOUNTED_P(array_ptr) &&
+				     Z_REFCOUNT_P(array_ptr) > 1)) {
 					zval_copy_ctor(array_ptr);
 				}
 				Z_ADDREF_P(array_ref);
@@ -14118,7 +14124,10 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARG
 					ZVAL_UNREF(array_ref);
 					array_ptr = array_ref;
 				}
-				if (Z_IMMUTABLE_P(array_ptr)) {
+				if (Z_IMMUTABLE_P(array_ptr) ||
+				    (Z_ISREF_P(array_ref) &&
+				     Z_REFCOUNTED_P(array_ptr) &&
+				     Z_REFCOUNT_P(array_ptr) > 1)) {
 					zval_copy_ctor(array_ptr);
 				}
 				Z_ADDREF_P(array_ref);
@@ -31476,7 +31485,10 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS
 					ZVAL_UNREF(array_ref);
 					array_ptr = array_ref;
 				}
-				if (Z_IMMUTABLE_P(array_ptr)) {
+				if (Z_IMMUTABLE_P(array_ptr) ||
+				    (Z_ISREF_P(array_ref) &&
+				     Z_REFCOUNTED_P(array_ptr) &&
+				     Z_REFCOUNT_P(array_ptr) > 1)) {
 					zval_copy_ctor(array_ptr);
 				}
 				Z_ADDREF_P(array_ref);