From: Nikita Popov <nikic@php.net>
Date: Sun, 13 Apr 2014 13:00:32 +0000 (+0200)
Subject: Copy varname before unset
X-Git-Tag: POST_PHPNG_MERGE~412^2~108
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=4fc3d2d104493e417d2352e4312d97a7d17fc4c5;p=php

Copy varname before unset

Otherwise we get issues when the varname variable coincides with
the variable that is deleted.
---

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index dbb89e6e63..3f714703ba 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -4005,6 +4005,7 @@ ZEND_VM_HANDLER(74, ZEND_UNSET_VAR, CONST|TMP|VAR|CV, UNUSED|CONST|VAR)
 	zval tmp, *varname;
 	HashTable *target_symbol_table;
 	zend_free_op free_op1;
+	zend_bool tmp_is_dup = 0;
 
 	SAVE_OPLINE();
 	if (OP1_TYPE == IS_CV &&
@@ -4023,8 +4024,10 @@ ZEND_VM_HANDLER(74, ZEND_UNSET_VAR, CONST|TMP|VAR|CV, UNUSED|CONST|VAR)
 		ZVAL_DUP(&tmp, varname);
 		convert_to_string(&tmp);
 		varname = &tmp;
+		tmp_is_dup = 1;
 	} else if (OP1_TYPE == IS_VAR || OP1_TYPE == IS_CV) {
-		if (Z_REFCOUNTED_P(varname)) Z_ADDREF_P(varname);
+		ZVAL_COPY(&tmp, varname);
+		varname = &tmp;
 	}
 
 	if (OP2_TYPE != IS_UNUSED) {
@@ -4036,10 +4039,10 @@ ZEND_VM_HANDLER(74, ZEND_UNSET_VAR, CONST|TMP|VAR|CV, UNUSED|CONST|VAR)
 			} else {
 				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
 				if (UNEXPECTED(EG(exception) != NULL)) {
-					if (OP1_TYPE != IS_CONST && varname == &tmp) {
+					if (OP1_TYPE != IS_CONST && tmp_is_dup) {
 						zval_dtor(&tmp);
 					} else if (OP1_TYPE == IS_VAR || OP1_TYPE == IS_CV) {
-						zval_ptr_dtor(varname);
+						zval_ptr_dtor(&tmp);
 					}
 					FREE_OP1();
 					HANDLE_EXCEPTION();
@@ -4058,10 +4061,10 @@ ZEND_VM_HANDLER(74, ZEND_UNSET_VAR, CONST|TMP|VAR|CV, UNUSED|CONST|VAR)
 		zend_hash_del_ind(target_symbol_table, Z_STR_P(varname));
 	}
 
-	if (OP1_TYPE != IS_CONST && varname == &tmp) {
+	if (OP1_TYPE != IS_CONST && tmp_is_dup) {
 		zval_dtor(&tmp);
 	} else if (OP1_TYPE == IS_VAR || OP1_TYPE == IS_CV) {
-		zval_ptr_dtor(varname);
+		zval_ptr_dtor(&tmp);
 	}
 	FREE_OP1();
 	CHECK_EXCEPTION();
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 643ebd644f..427ae46b62 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -4013,6 +4013,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HA
 	zval tmp, *varname;
 	HashTable *target_symbol_table;
 
+	zend_bool tmp_is_dup = 0;
 
 	SAVE_OPLINE();
 	if (IS_CONST == IS_CV &&
@@ -4031,8 +4032,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HA
 		ZVAL_DUP(&tmp, varname);
 		convert_to_string(&tmp);
 		varname = &tmp;
+		tmp_is_dup = 1;
 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
-		if (Z_REFCOUNTED_P(varname)) Z_ADDREF_P(varname);
+		ZVAL_COPY(&tmp, varname);
+		varname = &tmp;
 	}
 
 	if (IS_CONST != IS_UNUSED) {
@@ -4044,10 +4047,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HA
 			} else {
 				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
 				if (UNEXPECTED(EG(exception) != NULL)) {
-					if (IS_CONST != IS_CONST && varname == &tmp) {
+					if (IS_CONST != IS_CONST && tmp_is_dup) {
 						zval_dtor(&tmp);
 					} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
-						zval_ptr_dtor(varname);
+						zval_ptr_dtor(&tmp);
 					}
 
 					HANDLE_EXCEPTION();
@@ -4066,10 +4069,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HA
 		zend_hash_del_ind(target_symbol_table, Z_STR_P(varname));
 	}
 
-	if (IS_CONST != IS_CONST && varname == &tmp) {
+	if (IS_CONST != IS_CONST && tmp_is_dup) {
 		zval_dtor(&tmp);
 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
-		zval_ptr_dtor(varname);
+		zval_ptr_dtor(&tmp);
 	}
 
 	CHECK_EXCEPTION();
@@ -5650,6 +5653,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HAND
 	zval tmp, *varname;
 	HashTable *target_symbol_table;
 
+	zend_bool tmp_is_dup = 0;
 
 	SAVE_OPLINE();
 	if (IS_CONST == IS_CV &&
@@ -5668,8 +5672,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HAND
 		ZVAL_DUP(&tmp, varname);
 		convert_to_string(&tmp);
 		varname = &tmp;
+		tmp_is_dup = 1;
 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
-		if (Z_REFCOUNTED_P(varname)) Z_ADDREF_P(varname);
+		ZVAL_COPY(&tmp, varname);
+		varname = &tmp;
 	}
 
 	if (IS_VAR != IS_UNUSED) {
@@ -5681,10 +5687,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HAND
 			} else {
 				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
 				if (UNEXPECTED(EG(exception) != NULL)) {
-					if (IS_CONST != IS_CONST && varname == &tmp) {
+					if (IS_CONST != IS_CONST && tmp_is_dup) {
 						zval_dtor(&tmp);
 					} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
-						zval_ptr_dtor(varname);
+						zval_ptr_dtor(&tmp);
 					}
 
 					HANDLE_EXCEPTION();
@@ -5703,10 +5709,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HAND
 		zend_hash_del_ind(target_symbol_table, Z_STR_P(varname));
 	}
 
-	if (IS_CONST != IS_CONST && varname == &tmp) {
+	if (IS_CONST != IS_CONST && tmp_is_dup) {
 		zval_dtor(&tmp);
 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
-		zval_ptr_dtor(varname);
+		zval_ptr_dtor(&tmp);
 	}
 
 	CHECK_EXCEPTION();
@@ -6290,6 +6296,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_H
 	zval tmp, *varname;
 	HashTable *target_symbol_table;
 
+	zend_bool tmp_is_dup = 0;
 
 	SAVE_OPLINE();
 	if (IS_CONST == IS_CV &&
@@ -6308,8 +6315,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_H
 		ZVAL_DUP(&tmp, varname);
 		convert_to_string(&tmp);
 		varname = &tmp;
+		tmp_is_dup = 1;
 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
-		if (Z_REFCOUNTED_P(varname)) Z_ADDREF_P(varname);
+		ZVAL_COPY(&tmp, varname);
+		varname = &tmp;
 	}
 
 	if (IS_UNUSED != IS_UNUSED) {
@@ -6321,10 +6330,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_H
 			} else {
 				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
 				if (UNEXPECTED(EG(exception) != NULL)) {
-					if (IS_CONST != IS_CONST && varname == &tmp) {
+					if (IS_CONST != IS_CONST && tmp_is_dup) {
 						zval_dtor(&tmp);
 					} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
-						zval_ptr_dtor(varname);
+						zval_ptr_dtor(&tmp);
 					}
 
 					HANDLE_EXCEPTION();
@@ -6343,10 +6352,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_H
 		zend_hash_del_ind(target_symbol_table, Z_STR_P(varname));
 	}
 
-	if (IS_CONST != IS_CONST && varname == &tmp) {
+	if (IS_CONST != IS_CONST && tmp_is_dup) {
 		zval_dtor(&tmp);
 	} else if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
-		zval_ptr_dtor(varname);
+		zval_ptr_dtor(&tmp);
 	}
 
 	CHECK_EXCEPTION();
@@ -8944,6 +8953,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HAND
 	zval tmp, *varname;
 	HashTable *target_symbol_table;
 	zend_free_op free_op1;
+	zend_bool tmp_is_dup = 0;
 
 	SAVE_OPLINE();
 	if (IS_TMP_VAR == IS_CV &&
@@ -8962,8 +8972,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HAND
 		ZVAL_DUP(&tmp, varname);
 		convert_to_string(&tmp);
 		varname = &tmp;
+		tmp_is_dup = 1;
 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
-		if (Z_REFCOUNTED_P(varname)) Z_ADDREF_P(varname);
+		ZVAL_COPY(&tmp, varname);
+		varname = &tmp;
 	}
 
 	if (IS_CONST != IS_UNUSED) {
@@ -8975,10 +8987,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HAND
 			} else {
 				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
 				if (UNEXPECTED(EG(exception) != NULL)) {
-					if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
+					if (IS_TMP_VAR != IS_CONST && tmp_is_dup) {
 						zval_dtor(&tmp);
 					} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
-						zval_ptr_dtor(varname);
+						zval_ptr_dtor(&tmp);
 					}
 					zval_dtor(free_op1.var);
 					HANDLE_EXCEPTION();
@@ -8997,10 +9009,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HAND
 		zend_hash_del_ind(target_symbol_table, Z_STR_P(varname));
 	}
 
-	if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
+	if (IS_TMP_VAR != IS_CONST && tmp_is_dup) {
 		zval_dtor(&tmp);
 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
-		zval_ptr_dtor(varname);
+		zval_ptr_dtor(&tmp);
 	}
 	zval_dtor(free_op1.var);
 	CHECK_EXCEPTION();
@@ -10545,6 +10557,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLE
 	zval tmp, *varname;
 	HashTable *target_symbol_table;
 	zend_free_op free_op1;
+	zend_bool tmp_is_dup = 0;
 
 	SAVE_OPLINE();
 	if (IS_TMP_VAR == IS_CV &&
@@ -10563,8 +10576,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLE
 		ZVAL_DUP(&tmp, varname);
 		convert_to_string(&tmp);
 		varname = &tmp;
+		tmp_is_dup = 1;
 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
-		if (Z_REFCOUNTED_P(varname)) Z_ADDREF_P(varname);
+		ZVAL_COPY(&tmp, varname);
+		varname = &tmp;
 	}
 
 	if (IS_VAR != IS_UNUSED) {
@@ -10576,10 +10591,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLE
 			} else {
 				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
 				if (UNEXPECTED(EG(exception) != NULL)) {
-					if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
+					if (IS_TMP_VAR != IS_CONST && tmp_is_dup) {
 						zval_dtor(&tmp);
 					} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
-						zval_ptr_dtor(varname);
+						zval_ptr_dtor(&tmp);
 					}
 					zval_dtor(free_op1.var);
 					HANDLE_EXCEPTION();
@@ -10598,10 +10613,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLE
 		zend_hash_del_ind(target_symbol_table, Z_STR_P(varname));
 	}
 
-	if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
+	if (IS_TMP_VAR != IS_CONST && tmp_is_dup) {
 		zval_dtor(&tmp);
 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
-		zval_ptr_dtor(varname);
+		zval_ptr_dtor(&tmp);
 	}
 	zval_dtor(free_op1.var);
 	CHECK_EXCEPTION();
@@ -11071,6 +11086,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HAN
 	zval tmp, *varname;
 	HashTable *target_symbol_table;
 	zend_free_op free_op1;
+	zend_bool tmp_is_dup = 0;
 
 	SAVE_OPLINE();
 	if (IS_TMP_VAR == IS_CV &&
@@ -11089,8 +11105,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HAN
 		ZVAL_DUP(&tmp, varname);
 		convert_to_string(&tmp);
 		varname = &tmp;
+		tmp_is_dup = 1;
 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
-		if (Z_REFCOUNTED_P(varname)) Z_ADDREF_P(varname);
+		ZVAL_COPY(&tmp, varname);
+		varname = &tmp;
 	}
 
 	if (IS_UNUSED != IS_UNUSED) {
@@ -11102,10 +11120,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HAN
 			} else {
 				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
 				if (UNEXPECTED(EG(exception) != NULL)) {
-					if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
+					if (IS_TMP_VAR != IS_CONST && tmp_is_dup) {
 						zval_dtor(&tmp);
 					} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
-						zval_ptr_dtor(varname);
+						zval_ptr_dtor(&tmp);
 					}
 					zval_dtor(free_op1.var);
 					HANDLE_EXCEPTION();
@@ -11124,10 +11142,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HAN
 		zend_hash_del_ind(target_symbol_table, Z_STR_P(varname));
 	}
 
-	if (IS_TMP_VAR != IS_CONST && varname == &tmp) {
+	if (IS_TMP_VAR != IS_CONST && tmp_is_dup) {
 		zval_dtor(&tmp);
 	} else if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
-		zval_ptr_dtor(varname);
+		zval_ptr_dtor(&tmp);
 	}
 	zval_dtor(free_op1.var);
 	CHECK_EXCEPTION();
@@ -15266,6 +15284,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HAND
 	zval tmp, *varname;
 	HashTable *target_symbol_table;
 	zend_free_op free_op1;
+	zend_bool tmp_is_dup = 0;
 
 	SAVE_OPLINE();
 	if (IS_VAR == IS_CV &&
@@ -15284,8 +15303,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HAND
 		ZVAL_DUP(&tmp, varname);
 		convert_to_string(&tmp);
 		varname = &tmp;
+		tmp_is_dup = 1;
 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
-		if (Z_REFCOUNTED_P(varname)) Z_ADDREF_P(varname);
+		ZVAL_COPY(&tmp, varname);
+		varname = &tmp;
 	}
 
 	if (IS_CONST != IS_UNUSED) {
@@ -15297,10 +15318,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HAND
 			} else {
 				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
 				if (UNEXPECTED(EG(exception) != NULL)) {
-					if (IS_VAR != IS_CONST && varname == &tmp) {
+					if (IS_VAR != IS_CONST && tmp_is_dup) {
 						zval_dtor(&tmp);
 					} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
-						zval_ptr_dtor(varname);
+						zval_ptr_dtor(&tmp);
 					}
 					zval_ptr_dtor_nogc(free_op1.var);
 					HANDLE_EXCEPTION();
@@ -15319,10 +15340,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HAND
 		zend_hash_del_ind(target_symbol_table, Z_STR_P(varname));
 	}
 
-	if (IS_VAR != IS_CONST && varname == &tmp) {
+	if (IS_VAR != IS_CONST && tmp_is_dup) {
 		zval_dtor(&tmp);
 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
-		zval_ptr_dtor(varname);
+		zval_ptr_dtor(&tmp);
 	}
 	zval_ptr_dtor_nogc(free_op1.var);
 	CHECK_EXCEPTION();
@@ -19691,6 +19712,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLE
 	zval tmp, *varname;
 	HashTable *target_symbol_table;
 	zend_free_op free_op1;
+	zend_bool tmp_is_dup = 0;
 
 	SAVE_OPLINE();
 	if (IS_VAR == IS_CV &&
@@ -19709,8 +19731,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLE
 		ZVAL_DUP(&tmp, varname);
 		convert_to_string(&tmp);
 		varname = &tmp;
+		tmp_is_dup = 1;
 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
-		if (Z_REFCOUNTED_P(varname)) Z_ADDREF_P(varname);
+		ZVAL_COPY(&tmp, varname);
+		varname = &tmp;
 	}
 
 	if (IS_VAR != IS_UNUSED) {
@@ -19722,10 +19746,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLE
 			} else {
 				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
 				if (UNEXPECTED(EG(exception) != NULL)) {
-					if (IS_VAR != IS_CONST && varname == &tmp) {
+					if (IS_VAR != IS_CONST && tmp_is_dup) {
 						zval_dtor(&tmp);
 					} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
-						zval_ptr_dtor(varname);
+						zval_ptr_dtor(&tmp);
 					}
 					zval_ptr_dtor_nogc(free_op1.var);
 					HANDLE_EXCEPTION();
@@ -19744,10 +19768,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLE
 		zend_hash_del_ind(target_symbol_table, Z_STR_P(varname));
 	}
 
-	if (IS_VAR != IS_CONST && varname == &tmp) {
+	if (IS_VAR != IS_CONST && tmp_is_dup) {
 		zval_dtor(&tmp);
 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
-		zval_ptr_dtor(varname);
+		zval_ptr_dtor(&tmp);
 	}
 	zval_ptr_dtor_nogc(free_op1.var);
 	CHECK_EXCEPTION();
@@ -21114,6 +21138,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HAN
 	zval tmp, *varname;
 	HashTable *target_symbol_table;
 	zend_free_op free_op1;
+	zend_bool tmp_is_dup = 0;
 
 	SAVE_OPLINE();
 	if (IS_VAR == IS_CV &&
@@ -21132,8 +21157,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HAN
 		ZVAL_DUP(&tmp, varname);
 		convert_to_string(&tmp);
 		varname = &tmp;
+		tmp_is_dup = 1;
 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
-		if (Z_REFCOUNTED_P(varname)) Z_ADDREF_P(varname);
+		ZVAL_COPY(&tmp, varname);
+		varname = &tmp;
 	}
 
 	if (IS_UNUSED != IS_UNUSED) {
@@ -21145,10 +21172,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HAN
 			} else {
 				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
 				if (UNEXPECTED(EG(exception) != NULL)) {
-					if (IS_VAR != IS_CONST && varname == &tmp) {
+					if (IS_VAR != IS_CONST && tmp_is_dup) {
 						zval_dtor(&tmp);
 					} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
-						zval_ptr_dtor(varname);
+						zval_ptr_dtor(&tmp);
 					}
 					zval_ptr_dtor_nogc(free_op1.var);
 					HANDLE_EXCEPTION();
@@ -21167,10 +21194,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HAN
 		zend_hash_del_ind(target_symbol_table, Z_STR_P(varname));
 	}
 
-	if (IS_VAR != IS_CONST && varname == &tmp) {
+	if (IS_VAR != IS_CONST && tmp_is_dup) {
 		zval_dtor(&tmp);
 	} else if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
-		zval_ptr_dtor(varname);
+		zval_ptr_dtor(&tmp);
 	}
 	zval_ptr_dtor_nogc(free_op1.var);
 	CHECK_EXCEPTION();
@@ -32432,6 +32459,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDL
 	zval tmp, *varname;
 	HashTable *target_symbol_table;
 
+	zend_bool tmp_is_dup = 0;
 
 	SAVE_OPLINE();
 	if (IS_CV == IS_CV &&
@@ -32450,8 +32478,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDL
 		ZVAL_DUP(&tmp, varname);
 		convert_to_string(&tmp);
 		varname = &tmp;
+		tmp_is_dup = 1;
 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
-		if (Z_REFCOUNTED_P(varname)) Z_ADDREF_P(varname);
+		ZVAL_COPY(&tmp, varname);
+		varname = &tmp;
 	}
 
 	if (IS_CONST != IS_UNUSED) {
@@ -32463,10 +32493,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDL
 			} else {
 				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
 				if (UNEXPECTED(EG(exception) != NULL)) {
-					if (IS_CV != IS_CONST && varname == &tmp) {
+					if (IS_CV != IS_CONST && tmp_is_dup) {
 						zval_dtor(&tmp);
 					} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
-						zval_ptr_dtor(varname);
+						zval_ptr_dtor(&tmp);
 					}
 
 					HANDLE_EXCEPTION();
@@ -32485,10 +32515,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDL
 		zend_hash_del_ind(target_symbol_table, Z_STR_P(varname));
 	}
 
-	if (IS_CV != IS_CONST && varname == &tmp) {
+	if (IS_CV != IS_CONST && tmp_is_dup) {
 		zval_dtor(&tmp);
 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
-		zval_ptr_dtor(varname);
+		zval_ptr_dtor(&tmp);
 	}
 
 	CHECK_EXCEPTION();
@@ -36614,6 +36644,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER
 	zval tmp, *varname;
 	HashTable *target_symbol_table;
 
+	zend_bool tmp_is_dup = 0;
 
 	SAVE_OPLINE();
 	if (IS_CV == IS_CV &&
@@ -36632,8 +36663,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER
 		ZVAL_DUP(&tmp, varname);
 		convert_to_string(&tmp);
 		varname = &tmp;
+		tmp_is_dup = 1;
 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
-		if (Z_REFCOUNTED_P(varname)) Z_ADDREF_P(varname);
+		ZVAL_COPY(&tmp, varname);
+		varname = &tmp;
 	}
 
 	if (IS_VAR != IS_UNUSED) {
@@ -36645,10 +36678,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER
 			} else {
 				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
 				if (UNEXPECTED(EG(exception) != NULL)) {
-					if (IS_CV != IS_CONST && varname == &tmp) {
+					if (IS_CV != IS_CONST && tmp_is_dup) {
 						zval_dtor(&tmp);
 					} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
-						zval_ptr_dtor(varname);
+						zval_ptr_dtor(&tmp);
 					}
 
 					HANDLE_EXCEPTION();
@@ -36667,10 +36700,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER
 		zend_hash_del_ind(target_symbol_table, Z_STR_P(varname));
 	}
 
-	if (IS_CV != IS_CONST && varname == &tmp) {
+	if (IS_CV != IS_CONST && tmp_is_dup) {
 		zval_dtor(&tmp);
 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
-		zval_ptr_dtor(varname);
+		zval_ptr_dtor(&tmp);
 	}
 
 	CHECK_EXCEPTION();
@@ -37919,6 +37952,7 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HAND
 	zval tmp, *varname;
 	HashTable *target_symbol_table;
 
+	zend_bool tmp_is_dup = 0;
 
 	SAVE_OPLINE();
 	if (IS_CV == IS_CV &&
@@ -37937,8 +37971,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HAND
 		ZVAL_DUP(&tmp, varname);
 		convert_to_string(&tmp);
 		varname = &tmp;
+		tmp_is_dup = 1;
 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
-		if (Z_REFCOUNTED_P(varname)) Z_ADDREF_P(varname);
+		ZVAL_COPY(&tmp, varname);
+		varname = &tmp;
 	}
 
 	if (IS_UNUSED != IS_UNUSED) {
@@ -37950,10 +37986,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HAND
 			} else {
 				ce = zend_fetch_class_by_name(Z_STR_P(opline->op2.zv), opline->op2.literal + 1, 0 TSRMLS_CC);
 				if (UNEXPECTED(EG(exception) != NULL)) {
-					if (IS_CV != IS_CONST && varname == &tmp) {
+					if (IS_CV != IS_CONST && tmp_is_dup) {
 						zval_dtor(&tmp);
 					} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
-						zval_ptr_dtor(varname);
+						zval_ptr_dtor(&tmp);
 					}
 
 					HANDLE_EXCEPTION();
@@ -37972,10 +38008,10 @@ static int ZEND_FASTCALL  ZEND_UNSET_VAR_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HAND
 		zend_hash_del_ind(target_symbol_table, Z_STR_P(varname));
 	}
 
-	if (IS_CV != IS_CONST && varname == &tmp) {
+	if (IS_CV != IS_CONST && tmp_is_dup) {
 		zval_dtor(&tmp);
 	} else if (IS_CV == IS_VAR || IS_CV == IS_CV) {
-		zval_ptr_dtor(varname);
+		zval_ptr_dtor(&tmp);
 	}
 
 	CHECK_EXCEPTION();