cvs: ZendEngine2 / zend_execute.c

dmitry Mon Dec 15 02:22:10 2003 EDT Modified files: /ZendEngine2 zend_execute.c Log: Bug #24773 was fixed (Zend/tests/bug24773.phpt) Assign_op operators (+=) were fixed for elements of overloaded objects Memory leaks during accessing ptoperies/elements of overloaded objects were fixed Index: ZendEngine2/zend_execute.c diff -u ZendEngine2/zend_execute.c:1.565 ZendEngine2/zend_execute.c:1.566 --- ZendEngine2/zend_execute.c:1.565 Sun Dec 14 11:09:07 2003 +++ ZendEngine2/zend_execute.c Mon Dec 15 02:22:09 2003 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: zend_execute.c,v 1.565 2003/12/14 16:09:07 zeev Exp $ */ +/* $Id: zend_execute.c,v 1.566 2003/12/15 07:22:09 dmitry Exp $ */ #define ZEND_INTENSIVE_DEBUGGING 0 @@ -425,6 +425,10 @@ T(result->u.var).var.ptr_ptr = NULL; /* see if we can nuke this */ SELECTIVE_PZVAL_LOCK(value, result); } + if (value->refcount == 0) { /* free property of overloaded object */ + zval_dtor(value); + safe_free_zval_ptr(value); + } } @@ -1109,6 +1113,9 @@ Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); if (z->refcount <= 1) { zval_dtor(z); + if (z->refcount == 0) { /* free property of overloaded object */ + safe_free_zval_ptr(z); + } } } @@ -1158,6 +1165,9 @@ Z_OBJ_HT_P(object)->write_property(object, property, z TSRMLS_CC); if (z->refcount <= 1) { zval_dtor(z); + if (z->refcount == 0) { /* free property of overloaded object */ + safe_free_zval_ptr(z); + } } } @@ -1564,6 +1574,9 @@ SELECTIVE_PZVAL_LOCK(*retval, result); if (z->refcount <= 1) { zval_dtor(z); + if (z->refcount == 0) { /* free property of overloaded object */ + safe_free_zval_ptr(z); + } } } @@ -1591,17 +1604,15 @@ return zend_binary_assign_op_obj_helper(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU); break; case ZEND_ASSIGN_DIM: { - zend_op *op_data = EX(opline)+1; zval **object_ptr = get_obj_zval_ptr_ptr(&EX(opline)->op1, EX(Ts), BP_VAR_W TSRMLS_CC); + (*object_ptr)->refcount++; /* undo the effect of get_obj_zval_ptr_ptr() */ + if ((*object_ptr)->type == IS_OBJECT) { - zend_assign_to_object(&EX(opline)->result, object_ptr, &EX(opline)->op2, &op_data->op1, EX(Ts), ZEND_ASSIGN_DIM TSRMLS_CC); - EX(opline)++; - NEXT_OPCODE(); + return zend_binary_assign_op_obj_helper(binary_op, ZEND_OPCODE_HANDLER_ARGS_PASSTHRU); } else { zend_op *data_opline = EX(opline)+1; - (*object_ptr)->refcount++; /* undo the effect of get_obj_zval_ptr_ptr() */ zend_fetch_dimension_address(&data_opline->op2, &EX(opline)->op1, &EX(opline)->op2, EX(Ts), BP_VAR_RW TSRMLS_CC); value = get_zval_ptr(&data_opline->op1, EX(Ts), &EG(free_op1), BP_VAR_R); @@ -1933,7 +1944,9 @@ } */ zend_fetch_dimension_address(&EX(opline)->result, &EX(opline)->op1, &EX(opline)->op2, EX(Ts), BP_VAR_R TSRMLS_CC); - if (EX_T(EX(opline)->result.u.var).var.ptr_ptr != NULL) { + if (EX_T(EX(opline)->result.u.var).var.ptr_ptr == NULL) { + zend_error(E_ERROR, "Cannot unset string offsets"); + } else { PZVAL_UNLOCK(*EX_T(EX(opline)->result.u.var).var.ptr_ptr); if (EX_T(EX(opline)->result.u.var).var.ptr_ptr != &EG(uninitialized_zval_ptr)) { SEPARATE_ZVAL_IF_NOT_REF(EX_T(EX(opline)->result.u.var).var.ptr_ptr); @@ -3481,6 +3494,9 @@ } Z_OBJ_HT_P(*container)->unset_dimension(*container, offset TSRMLS_CC); break; + case IS_STRING: + zend_error(E_ERROR, "Cannot unset string offsets"); + break; default: ht = NULL; break;