From: Xinchen Hui <laruence@gmail.com>
Date: Fri, 26 Aug 2016 10:32:54 +0000 (+0800)
Subject: Merge branch 'PHP-7.0' into PHP-7.1
X-Git-Tag: php-7.1.0RC1~60
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=557f1ccf0cc185d712597e11ecedff3171a69110;p=php

Merge branch 'PHP-7.0' into PHP-7.1

* PHP-7.0:
  Fixed bug #72943 (assign_dim on string doesn't reset hval)

Conflicts:
	Zend/zend_execute.c
---

557f1ccf0cc185d712597e11ecedff3171a69110
diff --cc NEWS
index cab8679113,1fc159a17b..7661933b24
--- a/NEWS
+++ b/NEWS
@@@ -1,9 -1,15 +1,10 @@@
  PHP                                                                        NEWS
  |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 -?? ??? 2016 PHP 7.0.11
 +?? ??? 2016, PHP 7.1.0RC1
  
  - Core:
+   . Fixed bug #72943 (assign_dim on string doesn't reset hval). (Laruence)
 -  . Fixed bug #72911 (Memleak in zend_binary_assign_op_obj_helper). (Laruence)
 -  . Fixed bug #72813 (Segfault with __get returned by ref). (Laruence)
 -  . Fixed bug #72767 (PHP Segfaults when trying to expand an infinite operator).
 -    (Nikita)
 -  . Fixed bug #72854 (PHP Crashes on duplicate destructor call). (Nikita)
 -  . Fixed bug #72857 (stream_socket_recvfrom read access violation). (Anatol)
 +  . Fixed bug #72598 (Reference is lost after array_slice()) (Nikita)
  
  - COM:
    . Fixed bug #72922 (COM called from PHP does not return out parameters).
diff --cc Zend/zend_execute.c
index d2411ad5c3,2882f3dc33..f0f249e243
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@@ -1324,18 -1324,28 +1324,19 @@@ static zend_never_inline void zend_assi
  		memset(Z_STRVAL_P(str) + old_len, ' ', offset - old_len);
  		Z_STRVAL_P(str)[offset+1] = 0;
  	} else if (!Z_REFCOUNTED_P(str)) {
 +		old_str = Z_STR_P(str);
  		Z_STR_P(str) = zend_string_init(Z_STRVAL_P(str), Z_STRLEN_P(str), 0);
  		Z_TYPE_INFO_P(str) = IS_STRING_EX;
 -	}
 -
 -	if (Z_TYPE_P(value) != IS_STRING) {
 -		zend_string *tmp = zval_get_string(value);
 -
 -		Z_STRVAL_P(str)[offset] = ZSTR_VAL(tmp)[0];
 -		zend_string_release(tmp);
 +		zend_string_release(old_str);
  	} else {
 -		Z_STRVAL_P(str)[offset] = Z_STRVAL_P(value)[0];
 +		SEPARATE_STRING(str);
+ 		zend_string_forget_hash_val(Z_STR_P(str));
  	}
 -	/*
 -	 * the value of an assignment to a string offset is undefined
 -	T(result->u.var).var = &T->str_offset.str;
 -	*/
  
 -	zend_string_release(old_str);
 -	if (result) {
 -		zend_uchar c = (zend_uchar)Z_STRVAL_P(str)[offset];
 +	Z_STRVAL_P(str)[offset] = c;
  
 +	if (result) {
 +		/* Return the new character */
  		if (CG(one_char_string)[c]) {
  			ZVAL_INTERNED_STR(result, CG(one_char_string)[c]);
  		} else {