From 5c6f0ebeabd5ee4d8bd79f158fd7ee968ac28c0d Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@php.net>
Date: Thu, 30 Sep 2010 14:11:51 +0000
Subject: [PATCH] Prevented crash in GC because of incorrect reference counting

---
 Zend/tests/gc_032.phpt | 40 ++++++++++++++++++++++++++++++++++++++++
 Zend/zend_execute.c    |  2 +-
 2 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 Zend/tests/gc_032.phpt

diff --git a/Zend/tests/gc_032.phpt b/Zend/tests/gc_032.phpt
new file mode 100644
index 0000000000..615b008e65
--- /dev/null
+++ b/Zend/tests/gc_032.phpt
@@ -0,0 +1,40 @@
+--TEST--
+GC 032: Crash in GC because of invalid reference counting
+--FILE--
+<?php
+$a = array();
+$b =& $a;
+$a[0] = $a;
+debug_zval_dump($a);
+$a = array(array());
+$b =& $a;
+$a[0][0] = $a;
+debug_zval_dump($a);
+?>
+--EXPECT--
+array(1) refcount(1){
+  [0]=>
+  array(1) refcount(3){
+    [0]=>
+    array(1) refcount(3){
+      [0]=>
+      *RECURSION*
+    }
+  }
+}
+array(1) refcount(1){
+  [0]=>
+  array(1) refcount(3){
+    [0]=>
+    array(1) refcount(1){
+      [0]=>
+      array(1) refcount(3){
+        [0]=>
+        array(1) refcount(1){
+          [0]=>
+          *RECURSION*
+        }
+      }
+    }
+  }
+}
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 5ddb03a8c3..2d9a8cdd58 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -714,8 +714,8 @@ static inline zval* zend_assign_to_variable(zval **variable_ptr_ptr, zval *value
 					ALLOC_ZVAL(variable_ptr);
 					*variable_ptr_ptr = variable_ptr;
 					*variable_ptr = *value;
-					zval_copy_ctor(variable_ptr);
 					Z_SET_REFCOUNT_P(variable_ptr, 1);
+					zval_copy_ctor(variable_ptr);
 				} else {
 					*variable_ptr_ptr = value;
 					Z_ADDREF_P(value);
-- 
2.50.1