com php-src: Fixed bug #66609 (php crashes with __get() and ++ operator in some cases): NEWS Zend/ tests/bug66609.phpt Zend/zend_vm_def.h Ze
nd/zend_vm_execute.h
| From: | Xinchen Hui | Date: | Tue, 10 Mar 2015 07:36:42 +0000 |
| Subject: | com php-src: Fixed bug #66609 (php crashes with __get() and ++ operator in some cases): NEWS Zend/ tests/bug66609.phpt Zend/zend_vm_def.h Ze nd/zend_vm_execute.h |
||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-85433@lists.php.net to get a copy of this message | ||
Commit: 6a6c273893178bb9b59c117e31761fe0193d0c9f
Author: Xinchen Hui <laruence@php.net> Tue, 10 Mar 2015 15:36:42 +0800
Parents: 22894e74c2b04d0506645059c2ffa776cf0ace45
Branches: PHP-5.5 PHP-5.6 master
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=6a6c273893178bb9b59c117e31761fe0193d0c9f
Log:
Fixed bug #66609 (php crashes with __get() and ++ operator in some cases)
Bugs:
https://bugs..php.net/66609
Changed paths:
M NEWS
A Zend/tests/bug66609.phpt
M Zend/zend_vm_def.h
M Zend/zend_vm_execute.h
diff --git a/NEWS b/NEWS index f347506..826be4c 100644 --- a/NEWS +++ b/NEWS @@ -3,8 +3,10 @@ PHP NEWS ?? ??? 2015, PHP 5.5.24 - Core: + . Fixed bug #66609 (php crashes with __get() and ++ operator in some cases). + (Dmitry, Laruence) . Fixed bug #67626 (User exceptions not properly handled in streams). - (Julian) + (Julian) . Fixed bug #68917 (parse_url fails on some partial urls). (Wei Dai) - Filter: diff --git a/Zend/tests/bug66609.phpt b/Zend/tests/bug66609.phpt new file mode 100644 index 0000000..e156000 --- /dev/null +++ b/Zend/tests/bug66609.phpt @@ -0,0 +1,27 @@ +--TEST-- +Bug #66609 (php crashes with __get() and ++ operator in some cases) +--FILE-- +<?php +$bar = new Bar; +$foo = new Foo; +class Bar { + public function __get($x) { + global $foo; + return $foo->foo; + } +} +class Foo { + public function __get($x) { + global $bar; + return $bar->bar; + } +} +$foo->blah += 1; //crash +++$foo->blah; //crash +$foo->blah++; //crash +$foo->blah--; //crash +--$foo->blah; //crash +echo "okey"; +?> +--EXPECT-- +okey diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index a795a75..b67d5b0 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -380,6 +380,7 @@ ZEND_VM_HELPER_EX(zend_binary_assign_op_obj_helper, VAR|UNUSED|CV, CONST|TMP|VAR if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -408,6 +409,7 @@ ZEND_VM_HELPER_EX(zend_binary_assign_op_obj_helper, VAR|UNUSED|CV, CONST|TMP|VAR } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -640,7 +642,10 @@ ZEND_VM_HELPER_EX(zend_pre_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR| if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -657,6 +662,7 @@ ZEND_VM_HELPER_EX(zend_pre_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR| incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -741,9 +747,10 @@ ZEND_VM_HELPER_EX(zend_post_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -762,6 +769,7 @@ ZEND_VM_HELPER_EX(zend_post_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index f6b285a..859a078 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -14156,6 +14156,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(int (*b if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -14184,6 +14185,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(int (*b } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -14415,7 +14417,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CONST(incdec_t if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -14432,6 +14437,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CONST(incdec_t incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -14516,9 +14522,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CONST(incdec_ if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -14537,6 +14544,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CONST(incdec_ incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -16665,6 +16673,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(int (*bin if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -16693,6 +16702,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(int (*bin } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -16925,7 +16935,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_TMP(incdec_t i if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -16942,6 +16955,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_TMP(incdec_t i incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -17026,9 +17040,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_TMP(incdec_t if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -17047,6 +17062,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_TMP(incdec_t incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -18754,6 +18770,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(int (*bin if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -18782,6 +18799,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(int (*bin } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -19014,7 +19032,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_VAR(incdec_t i if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -19031,6 +19052,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_VAR(incdec_t i incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -19115,9 +19137,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_VAR(incdec_t if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -19136,6 +19159,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_VAR(incdec_t incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -20950,6 +20974,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(int (* if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -20978,6 +21003,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(int (* } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -22382,6 +22408,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CV(int (*bina if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -22410,6 +22437,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CV(int (*bina } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -22641,7 +22669,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CV(incdec_t in if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -22658,6 +22689,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CV(incdec_t in incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -22742,9 +22774,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CV(incdec_t i if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -22763,6 +22796,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CV(incdec_t i incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -24332,6 +24366,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(int if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -24360,6 +24395,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(int } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -24590,7 +24626,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(incde if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -24607,6 +24646,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(incde incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -24691,9 +24731,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CONST(incd if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -24712,6 +24753,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CONST(incd incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -25746,6 +25788,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(int (* if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -25774,6 +25817,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(int (* } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -26005,7 +26049,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(incdec_ if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -26022,6 +26069,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(incdec_ incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -26106,9 +26154,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_TMP(incdec if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -26127,6 +26176,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_TMP(incdec incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -27064,6 +27114,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(int (* if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -27092,6 +27143,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(int (* } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -27323,7 +27375,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(incdec_ if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -27340,6 +27395,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(incdec_ incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -27424,9 +27480,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_VAR(incdec if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -27445,6 +27502,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_VAR(incdec incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -28383,6 +28441,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(int if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -28411,6 +28470,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(int } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -28809,6 +28869,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(int (*b if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -28837,6 +28898,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(int (*b } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -29067,7 +29129,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CV(incdec_t if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -29084,6 +29149,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CV(incdec_t incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -29168,9 +29234,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CV(incdec_ if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -29189,6 +29256,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CV(incdec_ incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -31615,6 +31683,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CONST(int (*bi if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -31643,6 +31712,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CONST(int (*bi } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -31873,7 +31943,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CONST(incdec_t if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -31890,6 +31963,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CONST(incdec_t incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -31974,9 +32048,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CONST(incdec_t if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -31995,6 +32070,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CONST(incdec_t incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -33889,6 +33965,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_TMP(int (*bina if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -33917,6 +33994,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_TMP(int (*bina } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -34148,7 +34226,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_TMP(incdec_t in if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -34165,6 +34246,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_TMP(incdec_t in incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -34249,9 +34331,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_TMP(incdec_t i if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -34270,6 +34353,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_TMP(incdec_t i incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -35840,6 +35924,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_VAR(int (*bina if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -35868,6 +35953,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_VAR(int (*bina } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -36099,7 +36185,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_VAR(incdec_t in if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -36116,6 +36205,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_VAR(incdec_t in incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -36200,9 +36290,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_VAR(incdec_t i if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -36221,6 +36312,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_VAR(incdec_t i incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -37897,6 +37989,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(int (*b if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -37925,6 +38018,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(int (*b } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -39181,6 +39275,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CV(int (*binar if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -39209,6 +39304,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CV(int (*binar } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -39439,7 +39535,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CV(incdec_t inc if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -39456,6 +39555,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CV(incdec_t inc incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -39540,9 +39640,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CV(incdec_t in if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -39561,6 +39662,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CV(incdec_t in incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else {
diff --git a/NEWS b/NEWS index f347506..826be4c 100644 --- a/NEWS +++ b/NEWS @@ -3,8 +3,10 @@ PHP NEWS ?? ??? 2015, PHP 5.5.24 - Core: + . Fixed bug #66609 (php crashes with __get() and ++ operator in some cases). + (Dmitry, Laruence) . Fixed bug #67626 (User exceptions not properly handled in streams). - (Julian) + (Julian) . Fixed bug #68917 (parse_url fails on some partial urls). (Wei Dai) - Filter: diff --git a/Zend/tests/bug66609.phpt b/Zend/tests/bug66609.phpt new file mode 100644 index 0000000..e156000 --- /dev/null +++ b/Zend/tests/bug66609.phpt @@ -0,0 +1,27 @@ +--TEST-- +Bug #66609 (php crashes with __get() and ++ operator in some cases) +--FILE-- +<?php +$bar = new Bar; +$foo = new Foo; +class Bar { + public function __get($x) { + global $foo; + return $foo->foo; + } +} +class Foo { + public function __get($x) { + global $bar; + return $bar->bar; + } +} +$foo->blah += 1; //crash +++$foo->blah; //crash +$foo->blah++; //crash +$foo->blah--; //crash +--$foo->blah; //crash +echo "okey"; +?> +--EXPECT-- +okey diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index a795a75..b67d5b0 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -380,6 +380,7 @@ ZEND_VM_HELPER_EX(zend_binary_assign_op_obj_helper, VAR|UNUSED|CV, CONST|TMP|VAR if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -408,6 +409,7 @@ ZEND_VM_HELPER_EX(zend_binary_assign_op_obj_helper, VAR|UNUSED|CV, CONST|TMP|VAR } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -640,7 +642,10 @@ ZEND_VM_HELPER_EX(zend_pre_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR| if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -657,6 +662,7 @@ ZEND_VM_HELPER_EX(zend_pre_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR| incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -741,9 +747,10 @@ ZEND_VM_HELPER_EX(zend_post_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -762,6 +769,7 @@ ZEND_VM_HELPER_EX(zend_post_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index f6b285a..859a078 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -14156,6 +14156,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(int (*b if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -14184,6 +14185,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(int (*b } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -14415,7 +14417,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CONST(incdec_t if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -14432,6 +14437,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CONST(incdec_t incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -14516,9 +14522,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CONST(incdec_ if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -14537,6 +14544,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CONST(incdec_ incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -16665,6 +16673,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(int (*bin if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -16693,6 +16702,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(int (*bin } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -16925,7 +16935,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_TMP(incdec_t i if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -16942,6 +16955,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_TMP(incdec_t i incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -17026,9 +17040,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_TMP(incdec_t if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -17047,6 +17062,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_TMP(incdec_t incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -18754,6 +18770,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(int (*bin if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -18782,6 +18799,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(int (*bin } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -19014,7 +19032,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_VAR(incdec_t i if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -19031,6 +19052,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_VAR(incdec_t i incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -19115,9 +19137,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_VAR(incdec_t if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -19136,6 +19159,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_VAR(incdec_t incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -20950,6 +20974,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(int (* if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -20978,6 +21003,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(int (* } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -22382,6 +22408,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CV(int (*bina if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -22410,6 +22437,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CV(int (*bina } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -22641,7 +22669,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CV(incdec_t in if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -22658,6 +22689,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CV(incdec_t in incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -22742,9 +22774,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CV(incdec_t i if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -22763,6 +22796,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CV(incdec_t i incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -24332,6 +24366,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(int if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -24360,6 +24395,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(int } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -24590,7 +24626,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(incde if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -24607,6 +24646,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(incde incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -24691,9 +24731,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CONST(incd if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -24712,6 +24753,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CONST(incd incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -25746,6 +25788,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(int (* if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -25774,6 +25817,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(int (* } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -26005,7 +26049,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(incdec_ if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -26022,6 +26069,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(incdec_ incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -26106,9 +26154,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_TMP(incdec if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -26127,6 +26176,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_TMP(incdec incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -27064,6 +27114,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(int (* if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -27092,6 +27143,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(int (* } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -27323,7 +27375,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(incdec_ if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -27340,6 +27395,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(incdec_ incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -27424,9 +27480,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_VAR(incdec if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -27445,6 +27502,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_VAR(incdec incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -28383,6 +28441,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(int if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -28411,6 +28470,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(int } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -28809,6 +28869,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(int (*b if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -28837,6 +28898,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(int (*b } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -29067,7 +29129,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CV(incdec_t if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -29084,6 +29149,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CV(incdec_t incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -29168,9 +29234,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CV(incdec_ if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -29189,6 +29256,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CV(incdec_ incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -31615,6 +31683,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CONST(int (*bi if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -31643,6 +31712,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CONST(int (*bi } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -31873,7 +31943,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CONST(incdec_t if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -31890,6 +31963,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CONST(incdec_t incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -31974,9 +32048,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CONST(incdec_t if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -31995,6 +32070,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CONST(incdec_t incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -33889,6 +33965,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_TMP(int (*bina if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -33917,6 +33994,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_TMP(int (*bina } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -34148,7 +34226,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_TMP(incdec_t in if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -34165,6 +34246,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_TMP(incdec_t in incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -34249,9 +34331,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_TMP(incdec_t i if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -34270,6 +34353,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_TMP(incdec_t i incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -35840,6 +35924,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_VAR(int (*bina if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -35868,6 +35953,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_VAR(int (*bina } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -36099,7 +36185,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_VAR(incdec_t in if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -36116,6 +36205,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_VAR(incdec_t in incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -36200,9 +36290,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_VAR(incdec_t i if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -36221,6 +36312,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_VAR(incdec_t i incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else { @@ -37897,6 +37989,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(int (*b if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -37925,6 +38018,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(int (*b } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -39181,6 +39275,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CV(int (*binar if (!have_get_ptr) { zval *z = NULL; + Z_ADDREF_P(object); if (opline->extended_value == ZEND_ASSIGN_OBJ) { if (Z_OBJ_HT_P(object)->read_property) { z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); @@ -39209,6 +39304,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CV(int (*binar } else /* if (opline->extended_value == ZEND_ASSIGN_DIM) */ { Z_OBJ_HT_P(object)->write_dimension(object, property, z TSRMLS_CC); } + zval_ptr_dtor(&object); if (RETURN_VALUE_USED(opline)) { PZVAL_LOCK(z); EX_T(opline->result.var).var.ptr = z; @@ -39439,7 +39535,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CV(incdec_t inc if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval *z; + + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -39456,6 +39555,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CV(incdec_t inc incdec_op(z); *retval = z; Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); SELECTIVE_PZVAL_LOCK(*retval, opline); zval_ptr_dtor(&z); } else { @@ -39540,9 +39640,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CV(incdec_t in if (!have_get_ptr) { if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) { - zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); - zval *z_copy; + zval *z, *z_copy; + Z_ADDREF_P(object); + z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) { zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC); @@ -39561,6 +39662,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CV(incdec_t in incdec_op(z_copy); Z_ADDREF_P(z); Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC); + zval_ptr_dtor(&object); zval_ptr_dtor(&z_copy); zval_ptr_dtor(&z); } else {