From cc134cef18bd0e25f5665297bf5e23a4f75c033a Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@php.net>
Date: Wed, 15 Nov 2006 16:05:26 +0000
Subject: [PATCH] Fixed bug #39445 (Calling debug_backtrace() in the
 __toString() function produces a crash)

---
 Zend/tests/bug39445.phpt      | 16 ++++++++++++++++
 Zend/zend_builtin_functions.c |  4 +++-
 2 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100755 Zend/tests/bug39445.phpt

diff --git a/Zend/tests/bug39445.phpt b/Zend/tests/bug39445.phpt
new file mode 100755
index 0000000000..cf1607f2dd
--- /dev/null
+++ b/Zend/tests/bug39445.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #39445 (Calling debug_backtrace() in the __toString() function produces a crash)
+--FILE--
+<?php
+class test {
+	public function __toString() {
+		debug_backtrace();
+		return 'lowercase';
+	}
+}
+
+	$test = new test();
+	echo strtoupper($test);
+?>
+--EXPECT--
+LOWERCASE
diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
index 3c90193a05..fd59b12bc2 100644
--- a/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@ -1755,7 +1755,9 @@ static zval *debug_backtrace_get_args(void ***curpos TSRMLS_DC)
 	while (--arg_count >= 0) {
 		arg = (zval **) p++;
 		if (*arg) {
-			SEPARATE_ZVAL_TO_MAKE_IS_REF(arg);
+			if ((*arg)->type != IS_OBJECT) {
+				SEPARATE_ZVAL_TO_MAKE_IS_REF(arg);
+			}
 			(*arg)->refcount++;
 			add_next_index_zval(arg_array, *arg);
 		} else {
-- 
2.50.1