From f449b04713ae3ab5be5024968849b35bf4fea2a4 Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikic@php.net>
Date: Thu, 10 Apr 2014 13:50:25 +0200
Subject: [PATCH] Fix some ZTS issues and leaks

---
 Zend/zend_builtin_functions.c | 2 +-
 Zend/zend_compile.c           | 6 +++++-
 Zend/zend_execute.c           | 2 ++
 Zend/zend_object_handlers.c   | 1 -
 Zend/zend_string.c            | 2 ++
 5 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
index b75343936c..0cafa71f97 100644
--- a/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@ -1149,7 +1149,7 @@ ZEND_FUNCTION(method_exists)
 					&& memcmp(lcname->val, ZEND_INVOKE_FUNC_NAME, sizeof(ZEND_INVOKE_FUNC_NAME)-1) == 0) ? 1 : 0);
 					
 				STR_FREE(lcname);
-				STR_FREE(func->common.function_name);
+				STR_RELEASE(func->common.function_name);
 				efree(func);
 				return;
 			}
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index bd678c6d8b..50aff60f1a 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -6864,12 +6864,16 @@ zend_bool zend_is_auto_global(zend_string *name TSRMLS_DC) /* {{{ */
 int zend_register_auto_global(zend_string *name, zend_bool jit, zend_auto_global_callback auto_global_callback TSRMLS_DC) /* {{{ */
 {
 	zend_auto_global auto_global;
+	int retval;
 
 	auto_global.name = zend_new_interned_string(name TSRMLS_CC);
 	auto_global.auto_global_callback = auto_global_callback;
 	auto_global.jit = jit;
 
-	return zend_hash_add_mem(CG(auto_globals), name, &auto_global, sizeof(zend_auto_global)) != NULL ? SUCCESS : FAILURE;
+	retval = zend_hash_add_mem(CG(auto_globals), name, &auto_global, sizeof(zend_auto_global)) != NULL ? SUCCESS : FAILURE;
+
+	STR_RELEASE(auto_global.name);
+	return retval;
 }
 /* }}} */
 
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 822ec902a3..e4090081a6 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -697,6 +697,7 @@ static inline void zend_assign_to_object(zval *retval, zval *object_ptr, zval *p
 		value = &tmp;
 	} else if (value_type == IS_CONST) {
 		ZVAL_DUP(&tmp, value);
+		value = &tmp;
 	} else if (Z_REFCOUNTED_P(value)) {
 		Z_ADDREF_P(value);
 	}
@@ -1107,6 +1108,7 @@ fetch_from_array:
 	} else if (EXPECTED(Z_TYPE_P(container) == IS_STRING)) {
 		if (type != BP_VAR_UNSET && UNEXPECTED(Z_STRLEN_P(container) == 0)) {
 convert_to_array:
+			zval_dtor(container);
 			array_init(container);
 			goto fetch_from_array;
 		}
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index 2150ad5773..5dba067023 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -1476,7 +1476,6 @@ found:
 						zend_std_call_getter(object, member, &rv TSRMLS_CC);
 						(*guard) &= ~IN_GET;
 						if (Z_TYPE(rv) != IS_UNDEF) {
-							if (Z_REFCOUNTED(rv)) Z_ADDREF(rv);
 							result = i_zend_is_true(&rv TSRMLS_CC);
 							zval_ptr_dtor(&rv);
 						} else {
diff --git a/Zend/zend_string.c b/Zend/zend_string.c
index d95d0e9e15..aafd8da5bb 100644
--- a/Zend/zend_string.c
+++ b/Zend/zend_string.c
@@ -78,6 +78,8 @@ void zend_interned_strings_dtor(TSRMLS_D)
 	zend_hash_destroy(&CG(interned_strings));
 //???	free(CG(interned_strings).arData);
 //???	free(CG(interned_strings).arHash);
+#else
+	free(CG(empty_string));
 #endif
 }
 
-- 
2.40.0