From 62ab40bc9642798a9af0435ef3284a4f5d9bf6d4 Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@zend.com>
Date: Tue, 23 Aug 2016 12:14:31 +0300
Subject: [PATCH] Added tests and NEWS entry Fixed bug #72598 (Reference is
 lost after array_slice())

---
 NEWS                       |  3 +++
 Zend/tests/bug72598.phpt   | 26 ++++++++++++++++++++++++++
 Zend/tests/bug72598_2.phpt | 27 +++++++++++++++++++++++++++
 3 files changed, 56 insertions(+)
 create mode 100644 Zend/tests/bug72598.phpt
 create mode 100644 Zend/tests/bug72598_2.phpt

diff --git a/NEWS b/NEWS
index 31eded8861..ca0f198f94 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2016, PHP 7.1.0RC1
 
+- Core:
+  . Fixed bug #72598 (Reference is lost after array_slice()) (Nikita)
+
 -GD:
   . Fixed bug #66005 (imagecopy does not support 1bit transparency on truecolor
     images). (cmb)
diff --git a/Zend/tests/bug72598.phpt b/Zend/tests/bug72598.phpt
new file mode 100644
index 0000000000..dfb09a05b8
--- /dev/null
+++ b/Zend/tests/bug72598.phpt
@@ -0,0 +1,26 @@
+--TEST--
+Bug #72598 (Reference is lost after array_slice())
+--FILE--
+<?php
+function ref(&$ref) {
+	var_dump($ref);
+}
+
+new class {
+        function __construct() {
+                $args = [&$this];
+                for ($i = 0; $i < 2; $i++) {
+                        $a = array_slice($args, 0, 1);
+                        call_user_func_array('ref', $a);
+                }
+        }
+};
+?>
+--EXPECTF--
+Warning: Parameter 1 to ref() expected to be a reference, value given in %sbug72598.php on line 11
+object(class@anonymous)#1 (0) {
+}
+
+Warning: Parameter 1 to ref() expected to be a reference, value given in %sbug72598.php on line 11
+object(class@anonymous)#1 (0) {
+}
diff --git a/Zend/tests/bug72598_2.phpt b/Zend/tests/bug72598_2.phpt
new file mode 100644
index 0000000000..c3943806ff
--- /dev/null
+++ b/Zend/tests/bug72598_2.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Bug #72598.2 (Reference is lost after array_slice())
+--FILE--
+<?php
+function ref(&$ref) {
+	var_dump($ref);
+	$ref = 1;
+}
+
+new class {
+        function __construct() {
+		$b = 0;
+                $args = [&$b];
+		unset($b);
+                for ($i = 0; $i < 2; $i++) {
+                        $a = array_slice($args, 0, 1);
+                        call_user_func_array('ref', $a);
+                }
+        }
+};
+?>
+--EXPECTF--
+Warning: Parameter 1 to ref() expected to be a reference, value given in %sbug72598_2.php on line 14
+int(0)
+
+Warning: Parameter 1 to ref() expected to be a reference, value given in %sbug72598_2.php on line 14
+int(0)
-- 
2.50.1