From: Nikita Popov <nikic@php.net>
Date: Mon, 13 Oct 2014 12:51:53 +0000 (+0200)
Subject: Fix array/object cast of refcounted tmp var
X-Git-Tag: POST_NATIVE_TLS_MERGE^2~74^2~8
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e62edf2e58c31349498b3dcedd44b64d8fb1837f;p=php

Fix array/object cast of refcounted tmp var
---

diff --git a/Zend/tests/double_array_cast.phpt b/Zend/tests/double_array_cast.phpt
new file mode 100644
index 0000000000..aaee8cd919
--- /dev/null
+++ b/Zend/tests/double_array_cast.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Double array cast
+--FILE--
+<?php
+
+$array = [1, 2, $x = 3];
+var_dump((array) (array) $array);
+
+?>
+--EXPECT--
+array(3) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+}
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 983029f359..a98e82d83a 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -4043,7 +4043,7 @@ ZEND_VM_HANDLER(21, ZEND_CAST, CONST|TMP|VAR|CV, ANY)
 					if (Z_OPT_REFCOUNTED_P(expr)) Z_ADDREF_P(expr);
 				}
 
-				FREE_OP1();
+				FREE_OP1_IF_VAR();
 				CHECK_EXCEPTION();
 				ZEND_VM_NEXT_OPCODE();
 			}
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index e18c7303be..2acd9f98c1 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -9695,7 +9695,6 @@ static int ZEND_FASTCALL  ZEND_CAST_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 					if (Z_OPT_REFCOUNTED_P(expr)) Z_ADDREF_P(expr);
 				}
 
-				zval_ptr_dtor_nogc(free_op1.var);
 				CHECK_EXCEPTION();
 				ZEND_VM_NEXT_OPCODE();
 			}