From: Nikita Popov <nikic@php.net>
Date: Tue, 6 May 2014 18:01:19 +0000 (+0200)
Subject: Fix throw by reference
X-Git-Tag: POST_PHPNG_MERGE~395
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=767b5eea7e23b85fc8e9c83eaca3ed958e2e1aef;p=php

Fix throw by reference

Reported by Timm Friebe
---

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 0518d7c71d..7657b6dcc1 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2917,7 +2917,7 @@ ZEND_VM_HANDLER(108, ZEND_THROW, CONST|TMP|VAR|CV, ANY)
 	zend_free_op free_op1;
 
 	SAVE_OPLINE();
-	value = GET_OP1_ZVAL_PTR(BP_VAR_R);
+	value = GET_OP1_ZVAL_PTR_DEREF(BP_VAR_R);
 
 	if (OP1_TYPE == IS_CONST || UNEXPECTED(Z_TYPE_P(value) != IS_OBJECT)) {
 		if (UNEXPECTED(EG(exception) != NULL)) {
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 5ba7e41757..e803acbdaa 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -12846,7 +12846,7 @@ static int ZEND_FASTCALL  ZEND_THROW_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 	zend_free_op free_op1;
 
 	SAVE_OPLINE();
-	value = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
+	value = _get_zval_ptr_var_deref(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
 
 	if (IS_VAR == IS_CONST || UNEXPECTED(Z_TYPE_P(value) != IS_OBJECT)) {
 		if (UNEXPECTED(EG(exception) != NULL)) {
@@ -29909,7 +29909,7 @@ static int ZEND_FASTCALL  ZEND_THROW_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 
 
 	SAVE_OPLINE();
-	value = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
+	value = _get_zval_ptr_cv_deref_BP_VAR_R(execute_data, opline->op1.var TSRMLS_CC);
 
 	if (IS_CV == IS_CONST || UNEXPECTED(Z_TYPE_P(value) != IS_OBJECT)) {
 		if (UNEXPECTED(EG(exception) != NULL)) {