From: Dmitry Stogov <dmitry@zend.com>
Date: Wed, 23 Jul 2014 20:37:15 +0000 (+0400)
Subject: Fixed crash on self-referencing constant expression (part of a constant AST)
X-Git-Tag: PRE_PHPNG_MERGE~62^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d909b6330e314bb434350317fda5bec185ea12c0;p=php

Fixed crash on self-referencing constant expression (part of a constant AST)
---

diff --git a/Zend/tests/constant_expressions_self_referencing_array.phpt b/Zend/tests/constant_expressions_self_referencing_array.phpt
index 09f862e048..ae76a08602 100644
--- a/Zend/tests/constant_expressions_self_referencing_array.phpt
+++ b/Zend/tests/constant_expressions_self_referencing_array.phpt
@@ -1,7 +1,5 @@
 --TEST--
 Self-referencing constant expression (part of a constant AST)
---XFAIL--
-Not yet fixed, to be fixed for PHP 5.6
 --FILE--
 <?php
 class A {
diff --git a/Zend/zend_ast.c b/Zend/zend_ast.c
index 12f9405523..a7df0adbab 100644
--- a/Zend/zend_ast.c
+++ b/Zend/zend_ast.c
@@ -251,10 +251,19 @@ ZEND_API void zend_ast_evaluate(zval *result, zend_ast *ast, zend_class_entry *s
 			zval_dtor(&op2);
 			break;
 		case ZEND_CONST:
-			*result = *ast->u.val;
-			zval_copy_ctor(result);
-			if (IS_CONSTANT_TYPE(Z_TYPE_P(result))) {
-				zval_update_constant_ex(&result, 1, scope TSRMLS_CC);
+			/* class constants may be updated in-place */
+			if (scope) {
+				if (IS_CONSTANT_TYPE(Z_TYPE_P(ast->u.val))) {
+					zval_update_constant_ex(&ast->u.val, 1, scope TSRMLS_CC);
+				}
+				*result = *ast->u.val;
+				zval_copy_ctor(result);
+			} else {
+				*result = *ast->u.val;
+				zval_copy_ctor(result);
+				if (IS_CONSTANT_TYPE(Z_TYPE_P(result))) {
+					zval_update_constant_ex(&result, 1, scope TSRMLS_CC);
+				}
 			}
 			break;
 		case ZEND_BOOL_AND:
diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index 703e14113f..02a19c0aaa 100644
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -728,12 +728,17 @@ static void _parameter_string(string *str, zend_function *fptr, struct _zend_arg
 		if (precv && precv->opcode == ZEND_RECV_INIT && precv->op2_type != IS_UNUSED) {
 			zval *zv, zv_copy;
 			int use_copy;
+			zend_class_entry *old_scope;
+
 			string_write(str, " = ", sizeof(" = ")-1);
 			ALLOC_ZVAL(zv);
 			*zv = *precv->op2.zv;
 			zval_copy_ctor(zv);
 			INIT_PZVAL(zv);
-			zval_update_constant_ex(&zv, 1, fptr->common.scope TSRMLS_CC);
+			old_scope = EG(scope);
+			EG(scope) = fptr->common.scope;
+			zval_update_constant_ex(&zv, 1, NULL TSRMLS_CC);
+			EG(scope) = old_scope;
 			if (Z_TYPE_P(zv) == IS_BOOL) {
 				if (Z_LVAL_P(zv)) {
 					string_write(str, "true", sizeof("true")-1);
@@ -2579,6 +2584,7 @@ ZEND_METHOD(reflection_parameter, getDefaultValue)
 {
 	parameter_reference *param;
 	zend_op *precv;
+	zend_class_entry *old_scope;
 
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
@@ -2599,7 +2605,10 @@ ZEND_METHOD(reflection_parameter, getDefaultValue)
 	if (!IS_CONSTANT_TYPE(Z_TYPE_P(return_value))) {
 		zval_copy_ctor(return_value);
 	}
-	zval_update_constant_ex(&return_value, 0, param->fptr->common.scope TSRMLS_CC);
+	old_scope = EG(scope);
+	EG(scope) = param->fptr->common.scope;
+	zval_update_constant_ex(&return_value, 0, NULL TSRMLS_CC);
+	EG(scope) = old_scope;
 }
 /* }}} */