From 4c379392b2873cf2d5407cade3f747401f7df96c Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@gmail.com>
Date: Wed, 9 Dec 2015 21:07:59 +0800
Subject: [PATCH] Fixed bug #71067 (Local object in class method stays in
 memory for each call)

---
 NEWS                     |  4 ++++
 Zend/tests/bug71067.phpt | 31 +++++++++++++++++++++++++++++++
 Zend/zend_execute.c      |  6 ++++++
 3 files changed, 41 insertions(+)
 create mode 100644 Zend/tests/bug71067.phpt

diff --git a/NEWS b/NEWS
index 33bd38cc55..8766bbbbff 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Jan 2016 PHP 7.0.2
 
+- Core:
+  . Fixed bug #71067 (Local object in class method stays in memory for each
+    call). (Laruence)
+
 - Mbstring:
   . Fixed bug #71066 (mb_send_mail: Program terminated with signal SIGSEGV,
     Segmentation fault). (Laruence)
diff --git a/Zend/tests/bug71067.phpt b/Zend/tests/bug71067.phpt
new file mode 100644
index 0000000000..b2a1b31811
--- /dev/null
+++ b/Zend/tests/bug71067.phpt
@@ -0,0 +1,31 @@
+--TEST--
+Bug #71067 (Local object in class method stays in memory for each call)
+--INI--
+opcache.enable=0
+error_reporting=0
+--FILE--
+<?php
+class Test {
+	public function test(){
+		$arr = (object) [
+			'children' => []
+		];
+		$arr->children[] = 1;
+		return $arr;
+	}
+}
+
+$o = new Test();
+$o->test();
+
+print_r($o->test());
+?>
+--EXPECT--
+stdClass Object
+(
+    [children] => Array
+        (
+            [0] => 1
+        )
+
+)
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index f851833a2d..2ca3114cc7 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1954,6 +1954,12 @@ static zend_always_inline void zend_fetch_property_address(zval *result, zval *c
 				return;
 			}
 		} else if (EXPECTED(zobj->properties != NULL)) {
+			if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)) {
+				if (EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
+					GC_REFCOUNT(zobj->properties)--;
+				}
+				zobj->properties = zend_array_dup(zobj->properties);
+			}
 			retval = zend_hash_find(zobj->properties, Z_STR_P(prop_ptr));
 			if (EXPECTED(retval)) {
 				ZVAL_INDIRECT(result, retval);
-- 
2.40.0