From: Dmitry Stogov <dmitry@zend.com>
Date: Tue, 11 Mar 2014 10:49:25 +0000 (+0400)
Subject: Fixed reference handling
X-Git-Tag: POST_PHPNG_MERGE~412^2~341
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=8863df36532530e679392da30eff72c31b0d5a9c;p=php

Fixed reference handling
---

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 6049f658f0..0d594897ea 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1820,7 +1820,7 @@ ZEND_VM_HANDLER(39, ZEND_ASSIGN_REF, VAR|CV, VAR|CV)
 	zend_assign_to_variable_reference(variable_ptr, value_ptr TSRMLS_CC);
 
 	if (OP2_TYPE == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
-		Z_DELREF_P(variable_ptr);
+//???		Z_DELREF_P(variable_ptr);
 	}
 
 	if (RETURN_VALUE_USED(opline)) {
@@ -3160,7 +3160,10 @@ ZEND_VM_HANDLER(67, ZEND_SEND_REF, VAR|CV, ANY)
 	}
 
 	SEPARATE_ZVAL_TO_MAKE_IS_REF(varptr);
-	Z_ADDREF_P(varptr);
+//??? don't increment refcount of overloaded element
+	if (OP1_TYPE != IS_VAR || EXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) == IS_INDIRECT)) {
+		Z_ADDREF_P(varptr);
+	}
 	zend_vm_stack_push(varptr TSRMLS_CC);
 
 	FREE_OP1_VAR_PTR();
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 32042fc548..e33ad57577 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -12962,7 +12962,10 @@ static int ZEND_FASTCALL  ZEND_SEND_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARG
 	}
 
 	SEPARATE_ZVAL_TO_MAKE_IS_REF(varptr);
-	Z_ADDREF_P(varptr);
+//??? don't increment refcount of overloaded element
+	if (IS_VAR != IS_VAR || EXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) == IS_INDIRECT)) {
+		Z_ADDREF_P(varptr);
+	}
 	zend_vm_stack_push(varptr TSRMLS_CC);
 
 	if (free_op1.var) {zval_ptr_dtor_nogc(free_op1.var);};
@@ -19757,7 +19760,7 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDL
 	zend_assign_to_variable_reference(variable_ptr, value_ptr TSRMLS_CC);
 
 	if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
-		Z_DELREF_P(variable_ptr);
+//???		Z_DELREF_P(variable_ptr);
 	}
 
 	if (RETURN_VALUE_USED(opline)) {
@@ -23167,7 +23170,7 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLE
 	zend_assign_to_variable_reference(variable_ptr, value_ptr TSRMLS_CC);
 
 	if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
-		Z_DELREF_P(variable_ptr);
+//???		Z_DELREF_P(variable_ptr);
 	}
 
 	if (RETURN_VALUE_USED(opline)) {
@@ -30341,7 +30344,10 @@ static int ZEND_FASTCALL  ZEND_SEND_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS
 	}
 
 	SEPARATE_ZVAL_TO_MAKE_IS_REF(varptr);
-	Z_ADDREF_P(varptr);
+//??? don't increment refcount of overloaded element
+	if (IS_CV != IS_VAR || EXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) == IS_INDIRECT)) {
+		Z_ADDREF_P(varptr);
+	}
 	zend_vm_stack_push(varptr TSRMLS_CC);
 
 	CHECK_EXCEPTION();
@@ -36642,7 +36648,7 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLE
 	zend_assign_to_variable_reference(variable_ptr, value_ptr TSRMLS_CC);
 
 	if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
-		Z_DELREF_P(variable_ptr);
+//???		Z_DELREF_P(variable_ptr);
 	}
 
 	if (RETURN_VALUE_USED(opline)) {
@@ -39792,7 +39798,7 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER
 	zend_assign_to_variable_reference(variable_ptr, value_ptr TSRMLS_CC);
 
 	if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
-		Z_DELREF_P(variable_ptr);
+//???		Z_DELREF_P(variable_ptr);
 	}
 
 	if (RETURN_VALUE_USED(opline)) {