From: Xinchen Hui <laruence@gmail.com>
Date: Fri, 9 Dec 2016 14:22:59 +0000 (+0800)
Subject: Revert "Refix bug #73686"
X-Git-Tag: php-7.1.1RC1~113
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=6812721ef2c52ca7f518c6664a1933ffb58b3715;p=php

Revert "Refix bug #73686"

This reverts commit 4589386026dbf15d980ba0c7c92dc587cead15e8.
---

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 621fae74a3..647428f959 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1094,10 +1094,6 @@ static zend_never_inline void zend_assign_to_object_dim(zval *object, zval *dim,
 		return;
 	}
 
-	if (UNEXPECTED(Z_ISREF_P(value))) {
-		value = Z_REFVAL_P(value);
-	}
-
 	Z_OBJ_HT_P(object)->write_dimension(object, dim, value);
 }
 
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index bddf64ee57..d3fbb95991 100644
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -473,6 +473,11 @@ static void spl_array_write_dimension_ex(int check_inherited, zval *object, zval
 		return;
 	}
 
+	if (UNEXPECTED(Z_ISREF_P(value) &&
+		Z_REFCOUNTED_P(value) == 1)) {
+		ZVAL_UNREF(value);
+	}
+
 	if (Z_REFCOUNTED_P(value)) {
 		Z_ADDREF_P(value);
 	}