com php-src: Fixed Bug #70332 (Wrong behavior while returning reference on object): NEWS Zend/tests/bug70332.phpt Zend/zend_vm_def.h
Zend/zend_vm_execute.h

Commit: f56534e4b93f4c348298c223c95fcca38d95777e Author: Xinchen Hui <laruence@php.net> Sun, 23 Aug 2015 20:17:26 +0800 Parents: 4df6f2644252de00d70577c00a120ff674fee029 Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=f56534e4b93f4c348298c223c95fcca38d95777e Log: Fixed Bug #70332 (Wrong behavior while returning reference on object) This fix is actually made for array acessing bug fix (#70262) which is discarded since we have another better fix, anyway now seems this is still useful Bugs: https://bugs.php.net/70332 https://bugs.php.net/70262 Changed paths: M NEWS A Zend/tests/bug70332.phpt M Zend/zend_vm_def.h M Zend/zend_vm_execute.h Diff: diff --git a/NEWS b/NEWS index 51006c3..96fb512 100644 --- a/NEWS +++ b/NEWS @@ -3,6 +3,8 @@ PHP NEWS 03 Sep 2015, PHP 7.0.0 RC 2 - Core: + . Fixed bug #70332 (Wrong behavior while returning reference on object). + (Laruence, Dmitry) . Fixed bug #70300 (Syntactical inconsistency with new group use syntax). (marcio dot web2 at gmail dot com) . Fixed bug #70321 (Magic getter breaks reference to array property). diff --git a/Zend/tests/bug70332.phpt b/Zend/tests/bug70332.phpt new file mode 100644 index 0000000..217070f --- /dev/null +++ b/Zend/tests/bug70332.phpt @@ -0,0 +1,24 @@ +--TEST-- +Bug #70332 (Wrong behavior while returning reference on object) +--FILE-- +<?php +function & test($arg) { + return $arg; +} + +$arg = new Stdclass(); +$arg->name = array(); + +test($arg)->name[1] = "xxxx"; + +print_r($arg); +?> +--EXPECT-- +stdClass Object +( + [name] => Array + ( + [1] => xxxx + ) + +) diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index ff7e0b1..7950780 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -7247,11 +7247,11 @@ ZEND_VM_HANDLER(156, ZEND_SEPARATE, VAR, UNUSED) zval *var_ptr; var_ptr = EX_VAR(opline->op1.var); - if (Z_TYPE_P(var_ptr) != IS_OBJECT && - !Z_ISREF_P(var_ptr) && - Z_REFCOUNTED_P(var_ptr) && - Z_REFCOUNT_P(var_ptr) > 1) { - + if (UNEXPECTED(Z_ISREF_P(var_ptr))) { + if (UNEXPECTED(Z_REFCOUNT_P(var_ptr) == 1)) { + ZVAL_UNREF(var_ptr); + } + } else if (Z_COPYABLE_P(var_ptr) && Z_REFCOUNT_P(var_ptr) > 1) { Z_DELREF_P(var_ptr); ZVAL_DUP(EX_VAR(opline->op1.var), var_ptr); } diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index c256966..3f54a01 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -19441,11 +19441,11 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_SEPARATE_SPEC_VAR_UNUSED_HANDL zval *var_ptr; var_ptr = EX_VAR(opline->op1.var); - if (Z_TYPE_P(var_ptr) != IS_OBJECT && - !Z_ISREF_P(var_ptr) && - Z_REFCOUNTED_P(var_ptr) && - Z_REFCOUNT_P(var_ptr) > 1) { - + if (UNEXPECTED(Z_ISREF_P(var_ptr))) { + if (UNEXPECTED(Z_REFCOUNT_P(var_ptr) == 1)) { + ZVAL_UNREF(var_ptr); + } + } else if (Z_COPYABLE_P(var_ptr) && Z_REFCOUNT_P(var_ptr) > 1) { Z_DELREF_P(var_ptr); ZVAL_DUP(EX_VAR(opline->op1.var), var_ptr); }