From: Dmitry Stogov Date: Tue, 23 Oct 2007 12:52:40 +0000 (+0000) Subject: Fixed variations of bug #35163 X-Git-Tag: RELEASE_1_3_1~815 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1530fe99c8e504603dcc5fef555d331066827539;p=php Fixed variations of bug #35163 --- diff --git a/Zend/tests/bug35163_2.phpt b/Zend/tests/bug35163_2.phpt new file mode 100755 index 0000000000..4adf7709ae --- /dev/null +++ b/Zend/tests/bug35163_2.phpt @@ -0,0 +1,65 @@ +--TEST-- +Bug #35163.2 (Array elements can lose references) +--FILE-- + +--EXPECT-- +array(3) { + [0]=> + int(2) + [1]=> + &array(3) { + [0]=> + int(2) + [1]=> + &array(3) { + [0]=> + int(2) + [1]=> + *RECURSION* + [2]=> + *RECURSION* + } + [2]=> + &array(3) { + [0]=> + int(2) + [1]=> + *RECURSION* + [2]=> + *RECURSION* + } + } + [2]=> + &array(3) { + [0]=> + int(2) + [1]=> + &array(3) { + [0]=> + int(2) + [1]=> + *RECURSION* + [2]=> + *RECURSION* + } + [2]=> + &array(3) { + [0]=> + int(2) + [1]=> + *RECURSION* + [2]=> + *RECURSION* + } + } +} + diff --git a/Zend/tests/bug35163_3.phpt b/Zend/tests/bug35163_3.phpt new file mode 100755 index 0000000000..d2b3c25bfe --- /dev/null +++ b/Zend/tests/bug35163_3.phpt @@ -0,0 +1,39 @@ +--TEST-- +Bug #35163.3 (Array elements can lose references) +--FILE-- +b = array(1); +$a->b[] =& $a->b; +$a->b[] =& $a->b; +$a->b[0] = 2; +var_dump($a); +$a->b = null; +$a = null; +?> +--EXPECT-- +object(stdClass)#1 (1) { + ["b"]=> + &array(3) { + [0]=> + int(2) + [1]=> + &array(3) { + [0]=> + int(2) + [1]=> + *RECURSION* + [2]=> + *RECURSION* + } + [2]=> + &array(3) { + [0]=> + int(2) + [1]=> + *RECURSION* + [2]=> + *RECURSION* + } + } +} diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index e2a3621d13..291fce27b4 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -927,8 +927,8 @@ void zend_do_end_variable_parse(int type, int arg_offset TSRMLS_DC) if (le == NULL) break; opline_ptr = (zend_op *)le->data; } - if (opline->opcode == ZEND_FETCH_DIM_W) { - opline->extended_value = arg_offset; + if (type == BP_VAR_W && arg_offset) { + opline->extended_value = ZEND_FETCH_MAKE_REF; } } zend_llist_destroy(fetch_list_ptr); diff --git a/Zend/zend_compile.h b/Zend/zend_compile.h index af89f111fa..95109b0a2e 100644 --- a/Zend/zend_compile.h +++ b/Zend/zend_compile.h @@ -655,7 +655,8 @@ int zendlex(znode *zendlval TSRMLS_DC); #define ZEND_HANDLE_STREAM 5 #define ZEND_FETCH_STANDARD 0 -#define ZEND_FETCH_ADD_LOCK 1 +#define ZEND_FETCH_ADD_LOCK (1<<0) +#define ZEND_FETCH_MAKE_REF (1<<1) #define ZEND_FE_FETCH_BYREF 1 #define ZEND_FE_FETCH_WITH_KEY 2 diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index 7e1a41bbb6..599fe27044 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -981,6 +981,9 @@ ZEND_VM_HELPER_EX(zend_fetch_var_address_helper, CONST|TMP|VAR|CV, ANY, int type zval_dtor(varname); } if (!RETURN_VALUE_UNUSED(&opline->result)) { + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + SEPARATE_ZVAL_TO_MAKE_IS_REF(retval); + } EX_T(opline->result.u.var).var.ptr_ptr = retval; PZVAL_LOCK(*retval); switch (type) { @@ -1068,7 +1071,7 @@ ZEND_VM_HANDLER(84, ZEND_FETCH_DIM_W, VAR|CV, CONST|TMP|VAR|UNUSED|CV) FREE_OP1_VAR_PTR(); /* We are going to assign the result by reference */ - if (opline->extended_value) { + if (opline->extended_value) { Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); @@ -1239,7 +1242,7 @@ ZEND_VM_HANDLER(85, ZEND_FETCH_OBJ_W, VAR|UNUSED|CV, CONST|TMP|VAR|CV) zend_free_op free_op1, free_op2; zval *property = GET_OP2_ZVAL_PTR(BP_VAR_R); - if (opline->extended_value == ZEND_FETCH_ADD_LOCK && OP1_TYPE != IS_CV) { + if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && OP1_TYPE != IS_CV) { PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr; } @@ -1259,6 +1262,14 @@ ZEND_VM_HANDLER(85, ZEND_FETCH_OBJ_W, VAR|UNUSED|CV, CONST|TMP|VAR|CV) AI_USE_PTR(EX_T(opline->result.u.var).var); } FREE_OP1_VAR_PTR(); + + /* We are going to assign the result by reference */ + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); + Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + } + ZEND_VM_NEXT_OPCODE(); } diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index 7a9a99fcdf..d4f9a2623b 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -1280,6 +1280,9 @@ static int zend_fetch_var_address_helper_SPEC_CONST(int type, ZEND_OPCODE_HANDLE zval_dtor(varname); } if (!RETURN_VALUE_UNUSED(&opline->result)) { + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + SEPARATE_ZVAL_TO_MAKE_IS_REF(retval); + } EX_T(opline->result.u.var).var.ptr_ptr = retval; PZVAL_LOCK(*retval); switch (type) { @@ -4354,6 +4357,9 @@ static int zend_fetch_var_address_helper_SPEC_TMP(int type, ZEND_OPCODE_HANDLER_ zval_dtor(varname); } if (!RETURN_VALUE_UNUSED(&opline->result)) { + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + SEPARATE_ZVAL_TO_MAKE_IS_REF(retval); + } EX_T(opline->result.u.var).var.ptr_ptr = retval; PZVAL_LOCK(*retval); switch (type) { @@ -7410,6 +7416,9 @@ static int zend_fetch_var_address_helper_SPEC_VAR(int type, ZEND_OPCODE_HANDLER_ zval_dtor(varname); } if (!RETURN_VALUE_UNUSED(&opline->result)) { + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + SEPARATE_ZVAL_TO_MAKE_IS_REF(retval); + } EX_T(opline->result.u.var).var.ptr_ptr = retval; PZVAL_LOCK(*retval); switch (type) { @@ -9392,7 +9401,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS) zend_free_op free_op1; zval *property = &opline->op2.u.constant; - if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_VAR != IS_CV) { + if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_VAR != IS_CV) { PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr; } @@ -9412,6 +9421,14 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS) AI_USE_PTR(EX_T(opline->result.u.var).var); } if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; + + /* We are going to assign the result by reference */ + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); + Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + } + ZEND_VM_NEXT_OPCODE(); } @@ -11043,7 +11060,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS) zend_free_op free_op1, free_op2; zval *property = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); - if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_VAR != IS_CV) { + if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_VAR != IS_CV) { PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr; } @@ -11063,6 +11080,14 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS) AI_USE_PTR(EX_T(opline->result.u.var).var); } if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; + + /* We are going to assign the result by reference */ + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); + Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + } + ZEND_VM_NEXT_OPCODE(); } @@ -12630,7 +12655,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS) zend_free_op free_op1, free_op2; zval *property = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); - if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_VAR != IS_CV) { + if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_VAR != IS_CV) { PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr; } @@ -12650,6 +12675,14 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS) AI_USE_PTR(EX_T(opline->result.u.var).var); } if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; + + /* We are going to assign the result by reference */ + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); + Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + } + ZEND_VM_NEXT_OPCODE(); } @@ -14786,7 +14819,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS) zend_free_op free_op1; zval *property = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC); - if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_VAR != IS_CV) { + if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_VAR != IS_CV) { PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr; } @@ -14806,6 +14839,14 @@ static int ZEND_FETCH_OBJ_W_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS) AI_USE_PTR(EX_T(opline->result.u.var).var); } if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; + + /* We are going to assign the result by reference */ + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); + Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + } + ZEND_VM_NEXT_OPCODE(); } @@ -16117,7 +16158,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS) zend_free_op free_op1; zval *property = &opline->op2.u.constant; - if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_UNUSED != IS_CV) { + if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_UNUSED != IS_CV) { PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr; } @@ -16137,6 +16178,13 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS) AI_USE_PTR(EX_T(opline->result.u.var).var); } + /* We are going to assign the result by reference */ + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); + Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + } + ZEND_VM_NEXT_OPCODE(); } @@ -17149,7 +17197,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS) zend_free_op free_op1, free_op2; zval *property = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); - if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_UNUSED != IS_CV) { + if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_UNUSED != IS_CV) { PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr; } @@ -17169,6 +17217,13 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS) AI_USE_PTR(EX_T(opline->result.u.var).var); } + /* We are going to assign the result by reference */ + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); + Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + } + ZEND_VM_NEXT_OPCODE(); } @@ -18115,7 +18170,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS) zend_free_op free_op1, free_op2; zval *property = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); - if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_UNUSED != IS_CV) { + if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_UNUSED != IS_CV) { PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr; } @@ -18135,6 +18190,13 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS) AI_USE_PTR(EX_T(opline->result.u.var).var); } + /* We are going to assign the result by reference */ + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); + Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + } + ZEND_VM_NEXT_OPCODE(); } @@ -19346,7 +19408,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS) zend_free_op free_op1; zval *property = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC); - if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_UNUSED != IS_CV) { + if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_UNUSED != IS_CV) { PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr; } @@ -19366,6 +19428,13 @@ static int ZEND_FETCH_OBJ_W_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS) AI_USE_PTR(EX_T(opline->result.u.var).var); } + /* We are going to assign the result by reference */ + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); + Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + } + ZEND_VM_NEXT_OPCODE(); } @@ -20085,6 +20154,9 @@ static int zend_fetch_var_address_helper_SPEC_CV(int type, ZEND_OPCODE_HANDLER_A zval_dtor(varname); } if (!RETURN_VALUE_UNUSED(&opline->result)) { + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + SEPARATE_ZVAL_TO_MAKE_IS_REF(retval); + } EX_T(opline->result.u.var).var.ptr_ptr = retval; PZVAL_LOCK(*retval); switch (type) { @@ -21903,7 +21975,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS) zend_free_op free_op1; zval *property = &opline->op2.u.constant; - if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_CV != IS_CV) { + if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_CV != IS_CV) { PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr; } @@ -21923,6 +21995,13 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS) AI_USE_PTR(EX_T(opline->result.u.var).var); } + /* We are going to assign the result by reference */ + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); + Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + } + ZEND_VM_NEXT_OPCODE(); } @@ -23389,7 +23468,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS) zend_free_op free_op1, free_op2; zval *property = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); - if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_CV != IS_CV) { + if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_CV != IS_CV) { PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr; } @@ -23409,6 +23488,13 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS) AI_USE_PTR(EX_T(opline->result.u.var).var); } + /* We are going to assign the result by reference */ + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); + Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + } + ZEND_VM_NEXT_OPCODE(); } @@ -24878,7 +24964,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS) zend_free_op free_op1, free_op2; zval *property = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); - if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_CV != IS_CV) { + if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_CV != IS_CV) { PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr; } @@ -24898,6 +24984,13 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS) AI_USE_PTR(EX_T(opline->result.u.var).var); } + /* We are going to assign the result by reference */ + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); + Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + } + ZEND_VM_NEXT_OPCODE(); } @@ -26844,7 +26937,7 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS) zend_free_op free_op1; zval *property = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC); - if (opline->extended_value == ZEND_FETCH_ADD_LOCK && IS_CV != IS_CV) { + if ((opline->extended_value & ZEND_FETCH_ADD_LOCK) && IS_CV != IS_CV) { PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); EX_T(opline->op1.u.var).var.ptr = *EX_T(opline->op1.u.var).var.ptr_ptr; } @@ -26864,6 +26957,13 @@ static int ZEND_FETCH_OBJ_W_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS) AI_USE_PTR(EX_T(opline->result.u.var).var); } + /* We are going to assign the result by reference */ + if (opline->extended_value & ZEND_FETCH_MAKE_REF) { + Z_DELREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + SEPARATE_ZVAL_TO_MAKE_IS_REF(EX_T(opline->result.u.var).var.ptr_ptr); + Z_ADDREF_PP(EX_T(opline->result.u.var).var.ptr_ptr); + } + ZEND_VM_NEXT_OPCODE(); }