From: Nikita Popov <nikic@php.net>
Date: Mon, 26 May 2014 15:58:10 +0000 (+0200)
Subject: Fix incdec of ref object properties
X-Git-Tag: POST_PHPNG_MERGE~279
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ec7b5e0b19915a3ace184d519784f33afc64b9d8;p=php

Fix incdec of ref object properties

This fixes a number of infinite loops in the Symfony testsuite. It
took an obscene amount of time to track this down :/
---

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 2ab70e8fa1..163a493060 100644
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -2086,6 +2086,7 @@ static void increment_string(zval *str) /* {{{ */
 
 ZEND_API int increment_function(zval *op1) /* {{{ */
 {
+try_again:
 	switch (Z_TYPE_P(op1)) {
 		case IS_LONG:
 			if (Z_LVAL_P(op1) == LONG_MAX) {
@@ -2141,6 +2142,9 @@ ZEND_API int increment_function(zval *op1) /* {{{ */
 				return res;
 			}
 			return FAILURE;
+		case IS_REFERENCE:
+			op1 = Z_REFVAL_P(op1);
+			goto try_again;
 		default:
 			return FAILURE;
 	}
@@ -2153,6 +2157,7 @@ ZEND_API int decrement_function(zval *op1) /* {{{ */
 	long lval;
 	double dval;
 
+try_again:
 	switch (Z_TYPE_P(op1)) {
 		case IS_LONG:
 			if (Z_LVAL_P(op1) == LONG_MIN) {
@@ -2200,6 +2205,9 @@ ZEND_API int decrement_function(zval *op1) /* {{{ */
 				return res;
 			}
 			return FAILURE;
+		case IS_REFERENCE:
+			op1 = Z_REFVAL_P(op1);
+			goto try_again;
 		default:
 			return FAILURE;
 	}