From a382ede3e8b5fecfb44575fea6c079c69e7ad055 Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@php.net>
Date: Wed, 1 Aug 2007 10:56:45 +0000
Subject: [PATCH] Fixed bug #42119 (array_push($arr,&$obj) doesn't work with
 zend.ze1_compatibility_mode On)

---
 NEWS                     |  2 ++
 Zend/tests/bug42119.phpt | 19 +++++++++++++++++++
 Zend/zend_API.c          |  4 +++-
 3 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100755 Zend/tests/bug42119.phpt

diff --git a/NEWS b/NEWS
index e17841036a..6d391895f3 100644
--- a/NEWS
+++ b/NEWS
@@ -78,6 +78,8 @@ PHP                                                                        NEWS
   (Ilia)
 - Fixed bug #42134 (oci_error() returns false after oci_new_collection() 
   fails). (Tony)
+- Fixed bug #42119 (array_push($arr,&$obj) doesn't work with
+  zend.ze1_compatibility_mode On). (Dmitry)
 - Fixed Bug #42112 (deleting a node produces memory corruption). (Rob)
 - Fixed Bug #42107 (sscanf broken when using %2$s format parameters). (Jani)
 - Fixed bug #42090 (json_decode causes segmentation fault). (Hannes)
diff --git a/Zend/tests/bug42119.phpt b/Zend/tests/bug42119.phpt
new file mode 100755
index 0000000000..79d70f0aed
--- /dev/null
+++ b/Zend/tests/bug42119.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #42119 (array_push($arr,&$obj) doesn't work with zend.ze1_compatibility_mode On)
+--INI--
+allow_call_time_pass_reference=1
+zend.ze1_compatibility_mode=1
+--FILE--
+<?php
+class myclass {
+  var $item = 1;
+}
+
+$arr = array();
+@$myobj = new myclass();
+array_push($arr,&$myobj);
+$myobj->item = 2;
+echo $arr[0]->item,"\n";
+?>
+--EXPECT--
+2
diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index 96aaa47c9f..5092e8ca72 100644
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -154,7 +154,9 @@ ZEND_API int _zend_get_parameters_array_ex(int param_count, zval ***argument_arr
 	while (param_count-->0) {
 		zval **value = (zval**)(p-arg_count);
 
-		if (EG(ze1_compatibility_mode) && Z_TYPE_PP(value) == IS_OBJECT) {
+		if (EG(ze1_compatibility_mode) &&
+		    Z_TYPE_PP(value) == IS_OBJECT &&
+		    !(*value)->is_ref) {
 			zval *value_ptr;
 			char *class_name;
 			zend_uint class_name_len;
-- 
2.50.1