From: Dmitry Stogov <dmitry@zend.com>
Date: Tue, 16 Jun 2015 07:53:53 +0000 (+0300)
Subject: Fixed bug #69845 (ArrayObject with ARRAY_AS_PROPS broken)
X-Git-Tag: php-7.0.0alpha2~2^2~119
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=6ae375db31605e13c05c4c9b985898f8e3e4b61c;p=php

Fixed bug #69845 (ArrayObject with ARRAY_AS_PROPS broken)
---

diff --git a/NEWS b/NEWS
index 5ec8877681..c0c10979ed 100644
--- a/NEWS
+++ b/NEWS
@@ -32,6 +32,9 @@ PHP                                                                        NEWS
   . Fixed bug #69752 (PDOStatement::execute() leaks memory with DML
     Statements when closeCuror() is u). (Philip Hofstetter)
 
+- SPL
+  . Fixed bug #69845 (ArrayObject with ARRAY_AS_PROPS broken). (Dmitry)
+
 11 Jun 2015, PHP 7.0.0 Alpha 1
 
 - Core:
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 4ade06a5d8..70ae050594 100644
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -845,7 +845,7 @@ static zval *spl_array_read_property(zval *object, zval *member, int type, void
 	spl_array_object *intern = Z_SPLARRAY_P(object);
 
 	if ((intern->ar_flags & SPL_ARRAY_ARRAY_AS_PROPS) != 0
-		&& !std_object_handlers.has_property(object, member, 2, cache_slot)) {
+		&& !std_object_handlers.has_property(object, member, 2, NULL)) {
 		return spl_array_read_dimension(object, member, type, rv);
 	}
 	return std_object_handlers.read_property(object, member, type, cache_slot, rv);
@@ -856,7 +856,7 @@ static void spl_array_write_property(zval *object, zval *member, zval *value, vo
 	spl_array_object *intern = Z_SPLARRAY_P(object);
 
 	if ((intern->ar_flags & SPL_ARRAY_ARRAY_AS_PROPS) != 0
-	&& !std_object_handlers.has_property(object, member, 2, cache_slot)) {
+	&& !std_object_handlers.has_property(object, member, 2, NULL)) {
 		spl_array_write_dimension(object, member, value);
 		return;
 	}
@@ -868,7 +868,7 @@ static zval *spl_array_get_property_ptr_ptr(zval *object, zval *member, int type
 	spl_array_object *intern = Z_SPLARRAY_P(object);
 
 	if ((intern->ar_flags & SPL_ARRAY_ARRAY_AS_PROPS) != 0
-		&& !std_object_handlers.has_property(object, member, 2, cache_slot)) {
+		&& !std_object_handlers.has_property(object, member, 2, NULL)) {
 		return spl_array_get_dimension_ptr(1, object, member, type);
 	}
 	//!!! FIXME
@@ -881,7 +881,7 @@ static int spl_array_has_property(zval *object, zval *member, int has_set_exists
 	spl_array_object *intern = Z_SPLARRAY_P(object);
 
 	if ((intern->ar_flags & SPL_ARRAY_ARRAY_AS_PROPS) != 0
-		&& !std_object_handlers.has_property(object, member, 2, cache_slot)) {
+		&& !std_object_handlers.has_property(object, member, 2, NULL)) {
 		return spl_array_has_dimension(object, member, has_set_exists);
 	}
 	return std_object_handlers.has_property(object, member, has_set_exists, cache_slot);
@@ -892,7 +892,7 @@ static void spl_array_unset_property(zval *object, zval *member, void **cache_sl
 	spl_array_object *intern = Z_SPLARRAY_P(object);
 
 	if ((intern->ar_flags & SPL_ARRAY_ARRAY_AS_PROPS) != 0
-		&& !std_object_handlers.has_property(object, member, 2, cache_slot)) {
+		&& !std_object_handlers.has_property(object, member, 2, NULL)) {
 		spl_array_unset_dimension(object, member);
 		return;
 	}
diff --git a/ext/spl/tests/bug69845.phpt b/ext/spl/tests/bug69845.phpt
new file mode 100644
index 0000000000..db88a8e10d
--- /dev/null
+++ b/ext/spl/tests/bug69845.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Fixed bug #69845 (ArrayObject with ARRAY_AS_PROPS broken)
+--FILE--
+<?php
+for ($i = 0; $i<2; $i++) {
+	$data = new \ArrayObject(new stdClass(), ArrayObject::ARRAY_AS_PROPS);
+	$data->itemType = 'bulletin';
+	var_dump(!is_null($data['itemType']));
+}
+?>
+--EXPECT--
+bool(true)
+bool(true)