From 7f775864d1226857d2c0f1ae27cfe6a36c3ccbd0 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Fri, 18 Dec 2009 19:12:11 +0000
Subject: [PATCH] fix regression bug #50394: Reference argument converted to
 value in __call

---
 Zend/tests/bug50394.phpt       | 24 ++++++++++++++++++++++++
 Zend/tests/call_with_refs.phpt | 18 ++++++++++++++++++
 Zend/zend_execute_API.c        |  1 +
 3 files changed, 43 insertions(+)
 create mode 100644 Zend/tests/bug50394.phpt
 create mode 100644 Zend/tests/call_with_refs.phpt

diff --git a/Zend/tests/bug50394.phpt b/Zend/tests/bug50394.phpt
new file mode 100644
index 0000000000..e6069d3666
--- /dev/null
+++ b/Zend/tests/bug50394.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #50394: Reference argument converted to value in __call
+--FILE--
+<?php
+function inc( &$x ) { $x++; }
+
+class Proxy {
+        function __call( $name, $args ) {
+		echo "$name called!\n";
+                call_user_func_array( 'inc', $args );
+        }
+}
+
+$arg = 1;
+$args = array( &$arg );
+$proxy = new Proxy;
+call_user_func_array( array( $proxy, 'bar' ), $args );
+call_user_func_array( array( $proxy, 'bar' ), array(&$arg) );
+var_dump($arg);
+--EXPECT--	
+bar called!
+bar called!
+int(3)
+
diff --git a/Zend/tests/call_with_refs.phpt b/Zend/tests/call_with_refs.phpt
new file mode 100644
index 0000000000..acad134f87
--- /dev/null
+++ b/Zend/tests/call_with_refs.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Check call to non-ref function with call-time refs
+--FILE--
+<?php
+function my_errorhandler($errno,$errormsg) {
+  global $my_var;
+  $my_var=0x12345;
+  echo $errormsg."\n";
+  return true;
+}
+$oldhandler = set_error_handler("my_errorhandler");
+$my_var = str_repeat("A",64);
+$data = call_user_func_array("substr_replace",array(&$my_var, new StdClass(),1));
+echo "OK!";
+--EXPECT--	
+Object of class stdClass could not be converted to string
+Object of class stdClass to string conversion
+OK!
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index c27af2659f..a75f71bb58 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -873,6 +873,7 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
 		zval *param;
 
 		if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION 
+			&& (EX(function_state).function->common.fn_flags & ZEND_ACC_CALL_VIA_HANDLER) == 0 
 			&& !ARG_SHOULD_BE_SENT_BY_REF(EX(function_state).function, i + 1)
 			&& PZVAL_IS_REF(*fci->params[i])) {
 			SEPARATE_ZVAL(fci->params[i]);
-- 
2.50.1