From 54be40113d77f41cbf5a5078a265279140511c52 Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikita.ppv@gmail.com>
Date: Thu, 9 May 2019 12:02:16 +0200
Subject: [PATCH] Fixed bug #77951

Treat singleton references as non-references in ReflectionReference
and return null for them.
---
 ext/reflection/php_reflection.c               |  3 +-
 ext/reflection/tests/ReflectionReference.phpt | 28 +++++++++++--------
 2 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index 31c9fcc51b..da459e60be 100644
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -6176,7 +6176,8 @@ ZEND_METHOD(reflection_reference, fromArrayElement)
 		return;
 	}
 
-	if (Z_TYPE_P(item) != IS_REFERENCE) {
+	/* Treat singleton reference as non-reference. */
+	if (Z_TYPE_P(item) != IS_REFERENCE || Z_REFCOUNT_P(item) == 1) {
 		RETURN_NULL();
 	}
 
diff --git a/ext/reflection/tests/ReflectionReference.phpt b/ext/reflection/tests/ReflectionReference.phpt
index 76d2512123..2963c30232 100644
--- a/ext/reflection/tests/ReflectionReference.phpt
+++ b/ext/reflection/tests/ReflectionReference.phpt
@@ -3,39 +3,42 @@ Basic ReflectionReference functionality
 --FILE--
 <?php
 
-$ary = [0, 1, 2];
+$ary = [0, 1, 2, 3];
 $ref1 =& $ary[1];
 unset($ref1);
 $ref2 =& $ary[2];
+$ref3 =& $ary[3];
 
 echo "fromArrayElement():\n";
 $r0 = ReflectionReference::fromArrayElement($ary, 0);
 var_dump($r0 === null);
 $r1 = ReflectionReference::fromArrayElement($ary, 1);
-var_dump($r1 instanceof ReflectionReference);
+var_dump($r1 === null);
 $r2 = ReflectionReference::fromArrayElement($ary, 2);
 var_dump($r2 instanceof ReflectionReference);
+$r3 = ReflectionReference::fromArrayElement($ary, 3);
+var_dump($r2 instanceof ReflectionReference);
 
 echo "getId() #1:\n";
-var_dump($r1->getId() === $r1->getId());
 var_dump($r2->getId() === $r2->getId());
-var_dump($r1->getId() !== $r2->getId());
+var_dump($r3->getId() === $r3->getId());
+var_dump($r2->getId() !== $r3->getId());
 
 echo "getId() #2:\n";
-$ary2 = [&$ary[1], &$ref2];
-$r1_2 = ReflectionReference::fromArrayElement($ary2, 0);
-$r2_2 = ReflectionReference::fromArrayElement($ary2, 1);
-var_dump($r1->getId() === $r1_2->getId());
+$ary2 = [&$ary[2], &$ref3];
+$r2_2 = ReflectionReference::fromArrayElement($ary2, 0);
+$r3_2 = ReflectionReference::fromArrayElement($ary2, 1);
 var_dump($r2->getId() === $r2_2->getId());
+var_dump($r3->getId() === $r3_2->getId());
 
 echo "getId() #3:\n";
-$r1_id = $r1->getId();
 $r2_id = $r2->getId();
-unset($r0, $r1, $r2, $r1_2, $r2_2);
-$r1 = ReflectionReference::fromArrayElement($ary, 1);
+$r3_id = $r3->getId();
+unset($r0, $r1, $r2, $r3, $r2_2, $r3_2);
 $r2 = ReflectionReference::fromArrayElement($ary, 2);
-var_dump($r1_id === $r1->getId());
+$r3 = ReflectionReference::fromArrayElement($ary, 3);
 var_dump($r2_id === $r2->getId());
+var_dump($r3_id === $r3->getId());
 
 ?>
 --EXPECT--
@@ -43,6 +46,7 @@ fromArrayElement():
 bool(true)
 bool(true)
 bool(true)
+bool(true)
 getId() #1:
 bool(true)
 bool(true)
-- 
2.40.0