From: Dmitry Stogov <dmitry@zend.com>
Date: Fri, 11 Apr 2014 08:43:22 +0000 (+0400)
Subject: Fixed reference counting
X-Git-Tag: POST_PHPNG_MERGE~412^2~124
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ec4314f818d59653c0f27d2f5bd59813c874cd4d;p=php

Fixed reference counting
---

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 730450f8b4..b11bdfaf60 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -3152,14 +3152,17 @@ ZEND_VM_HANDLER(67, ZEND_SEND_REF, VAR|CV, ANY)
 
 	if (Z_ISREF_P(varptr)) {
 		Z_ADDREF_P(varptr);
+	} else if (OP1_TYPE == IS_VAR &&
+		EXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT)) {
+		zval tmp;
+		ZVAL_COPY_VALUE(&tmp, varptr);
+		varptr = &tmp;
+		SEPARATE_ZVAL_TO_MAKE_IS_REF(varptr);
 	} else {
 		SEPARATE_ZVAL_TO_MAKE_IS_REF(varptr);
-//??? don't increment refcount of overloaded element
-		if (OP1_TYPE != IS_VAR ||	
-		    EXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) == IS_INDIRECT)) {
-			Z_ADDREF_P(varptr);
-		}
+		Z_ADDREF_P(varptr);
 	}
+
 	zend_vm_stack_push(varptr TSRMLS_CC);
 
 	FREE_OP1_VAR_PTR();
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 8a108cd942..6deaa6dc01 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -12651,14 +12651,17 @@ static int ZEND_FASTCALL  ZEND_SEND_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARG
 
 	if (Z_ISREF_P(varptr)) {
 		Z_ADDREF_P(varptr);
+	} else if (IS_VAR == IS_VAR &&
+		EXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT)) {
+		zval tmp;
+		ZVAL_COPY_VALUE(&tmp, varptr);
+		varptr = &tmp;
+		SEPARATE_ZVAL_TO_MAKE_IS_REF(varptr);
 	} else {
 		SEPARATE_ZVAL_TO_MAKE_IS_REF(varptr);
-//??? don't increment refcount of overloaded element
-		if (IS_VAR != IS_VAR ||
-		    EXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) == IS_INDIRECT)) {
-			Z_ADDREF_P(varptr);
-		}
+		Z_ADDREF_P(varptr);
 	}
+
 	zend_vm_stack_push(varptr TSRMLS_CC);
 
 	if (free_op1.var) {zval_ptr_dtor_nogc(free_op1.var);};
@@ -30182,14 +30185,17 @@ static int ZEND_FASTCALL  ZEND_SEND_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS
 
 	if (Z_ISREF_P(varptr)) {
 		Z_ADDREF_P(varptr);
+	} else if (IS_CV == IS_VAR &&
+		EXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT)) {
+		zval tmp;
+		ZVAL_COPY_VALUE(&tmp, varptr);
+		varptr = &tmp;
+		SEPARATE_ZVAL_TO_MAKE_IS_REF(varptr);
 	} else {
 		SEPARATE_ZVAL_TO_MAKE_IS_REF(varptr);
-//??? don't increment refcount of overloaded element
-		if (IS_CV != IS_VAR ||
-		    EXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) == IS_INDIRECT)) {
-			Z_ADDREF_P(varptr);
-		}
+		Z_ADDREF_P(varptr);
 	}
+
 	zend_vm_stack_push(varptr TSRMLS_CC);
 
 	CHECK_EXCEPTION();