com php-src: Fixed bug #70321 (Magic getter breaks reference to array property) Note that the UNEXPECTED(zv) was turned into EXPECTED(zv), as zv is
mostly set in the context where it is used and usually anyway is checked first with OP*_TYPE == IS_VAR; or maybe jus t completely remove that
(UN)EXPECTED at this place...: NEWS Zend/tests/bug70321.p hpt Zend/zend_execute.c

Commit: 66754585f889e56ddaf3442fd4ac7b9adf93417b Author: Bob Weinand <bobwei9@hotmail.com> Sat, 22 Aug 2015 23:54:59 +0100 Parents: 76e3e99dd674fe98130ba110564c607b12a7772c Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=66754585f889e56ddaf3442fd4ac7b9adf93417b Log: Fixed bug #70321 (Magic getter breaks reference to array property) Note that the UNEXPECTED(zv) was turned into EXPECTED(zv), as zv is mostly set in the context where it is used and usually anyway is checked first with OP*_TYPE == IS_VAR; or maybe just completely remove that (UN)EXPECTED at this place... Bugs: https://bugs..php.net/70321 Changed paths: M NEWS A Zend/tests/bug70321.phpt M Zend/zend_execute.c Diff: diff --git a/NEWS b/NEWS index f92f283..4fdf0e6 100644 --- a/NEWS +++ b/NEWS @@ -7,6 +7,7 @@ PHP NEWS . Fixed bug #70300 (Syntactical inconsistency with new group use syntax). (marcio dot web2 at gmail dot com) . Fixed bug causing exception traces with anon classes to be truncated. (Bob) + . Fixed bug #70321 (Magic getter breaks reference to array property). (Bob) - PDO_OCI: . Fixed bug #70308 (PDO::ATTR_PREFETCH is ignored). (Chris Jones) diff --git a/Zend/tests/bug70321.phpt b/Zend/tests/bug70321.phpt new file mode 100644 index 0000000..b1cb87f --- /dev/null +++ b/Zend/tests/bug70321.phpt @@ -0,0 +1,31 @@ +--TEST-- +Bug #70321 (Magic getter breaks reference to array property) +--FILE-- +<?php + +class foo { + private $bar; + public function __construct() { + $this->bar = new bar(); + } + + public function &__get($key) { + $bar = $this->bar; + // no direct reference to $this->bar + return $bar; + } +} + +class bar { public $baz = []; } + +$foo = new foo(); +$foo->bar->baz[] = function() {}; +var_dump($foo->bar->baz); + +?> +--EXPECTF-- +array(1) { + [0]=> + object(Closure)#%d (0) { + } +} diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 59f936d..edb1f9d 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -89,7 +89,7 @@ static const zend_internal_function zend_pass_function = { #define zval_ptr_dtor(zv) i_zval_ptr_dtor(zv ZEND_FILE_LINE_CC) #define READY_TO_DESTROY(zv) \ - (UNEXPECTED(zv) && Z_REFCOUNTED_P(zv) && Z_REFCOUNT_P(zv) == 1) + (EXPECTED(zv) && Z_REFCOUNTED_P(zv) && Z_REFCOUNT_P(zv) == 1 && (EXPECTED(Z_ISREF_P(zv) == 0) || Z_REFCOUNTED_P(Z_REFVAL_P(zv)) && Z_REFCOUNT_P(Z_REFVAL_P(zv)) == 1)) #define EXTRACT_ZVAL_PTR(zv, check_null) do { \ zval *__zv = (zv); \