com php-src: Fixed bug #70223 (Incrementing value returned by magic getter): NEWS Zend/tests/bug70223.phpt Zend/zend_execute.c

Commit: aa546256e3f3ddf609f5f64ab977650a45652442 Author: Xinchen Hui <laruence@php.net> Mon, 10 Aug 2015 17:12:33 +0800 Parents: 73a69c9c03587dfa1dcfb488e27f5bb42218ed4f Branches: PHP-7.0.0 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=aa546256e3f3ddf609f5f64ab977650a45652442 Log: Fixed bug #70223 (Incrementing value returned by magic getter) Bugs: https://bugs.php.net/70223 Changed paths: M NEWS A Zend/tests/bug70223.phpt M Zend/zend_execute.c Diff: diff --git a/NEWS b/NEWS index bd0a195..e873181 100644 --- a/NEWS +++ b/NEWS @@ -3,6 +3,7 @@ PHP NEWS 20 Aug 2015, PHP 7..0.0 RC 1 - Core: + . Fixed bug #70223 (Incrementing value returned by magic getter). (Laruence) . Fixed bug #70215 (Segfault when __invoke is static). (Bob) - CLI server: diff --git a/Zend/tests/bug70223.phpt b/Zend/tests/bug70223.phpt new file mode 100644 index 0000000...7f1633a --- /dev/null +++ b/Zend/tests/bug70223.phpt @@ -0,0 +1,20 @@ +--TEST-- +Bug #70223 (Incrementing value returned by magic getter) +--FILE-- +<?php + +class A { + + private $foo = 0; + + public function &__get($foo){ return $this->foo; } + +} + +$a = new A; +echo $a->f++; +echo $a->f++; +echo $a->f++; +?> +--EXPECT-- +012 diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index b9a7ecf..0909656 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -1339,14 +1339,18 @@ static zend_never_inline void zend_post_incdec_overloaded_property(zval *object, } ZVAL_COPY_VALUE(z, value); } - ZVAL_COPY(result, z); - ZVAL_DUP(&z_copy, z); + + if (UNEXPECTED(Z_TYPE_P(z) == IS_REFERENCE)) { + ZVAL_COPY(result, Z_REFVAL_P(z)); + } else { + ZVAL_COPY(result, z); + } + ZVAL_DUP(&z_copy, result); if (inc) { increment_function(&z_copy); } else { decrement_function(&z_copy); } - if (Z_REFCOUNTED_P(z)) Z_ADDREF_P(z); Z_OBJ_HT(obj)->write_property(&obj, property, &z_copy, cache_slot); OBJ_RELEASE(Z_OBJ(obj)); zval_ptr_dtor(&z_copy);