From 95c9e3014ae7472f9c31ed7e02704ec5340ccb41 Mon Sep 17 00:00:00 2001 From: Zeev Suraski Date: Wed, 9 Jun 1999 21:39:12 +0000 Subject: [PATCH] * Fix cases where you assign an array element to the parent array (the array was being erased before the assignment, so the element was being smashed). --- Zend/zend_API.c | 2 +- Zend/zend_execute.c | 11 +++++++---- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/Zend/zend_API.c b/Zend/zend_API.c index a739fc1da9..6e30d592c7 100644 --- a/Zend/zend_API.c +++ b/Zend/zend_API.c @@ -326,7 +326,7 @@ ZEND_API inline int add_index_string(zval *arg, uint index, char *str, int dupli } tmp->refcount=1; tmp->is_ref=0; - return zend_hash_index_update(arg->value.ht, index, (void *) &tmp, sizeof(zval *),NULL); + return zend_hash_index_update(arg->value.ht, index, (void *) &tmp, sizeof(zval *), NULL); } diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 8557c7141f..b18a8ef27d 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -285,15 +285,18 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2 if (variable_ptr==value) { variable_ptr->refcount++; } else if (value->is_ref) { + zval tmp = *value; + + tmp = *value; + zval_copy_ctor(&tmp); + tmp.refcount=1; zendi_zval_dtor(*variable_ptr); - *variable_ptr = *value; - zval_copy_ctor(variable_ptr); - variable_ptr->refcount=1; + *variable_ptr = tmp; } else { + value->refcount++; zendi_zval_dtor(*variable_ptr); safe_free_zval_ptr(variable_ptr); *variable_ptr_ptr = value; - value->refcount++; } break; case IS_TMP_VAR: -- 2.40.0