cvs: ZendEngine2(PHP_5_0) / zend_execute.c zend_object_handlers.c /tests bug35239.phpt php-src NEWS

dmitry Wed Nov 16 06:52:01 2005 EDT Added files: (Branch: PHP_5_0) /ZendEngine2/tests bug35239.phpt Modified files: /php-src NEWS /ZendEngine2 zend_execute.c zend_object_handlers.c Log: Fixed bug #35239 (Objects can lose references) http://cvs.php.net/diff.php/php-src/NEWS?r1=1.1760.2.513&r2=1.1760.2.514&ty=u Index: php-src/NEWS diff -u php-src/NEWS:1.1760.2.513 php-src/NEWS:1.1760.2.514 --- php-src/NEWS:1.1760.2.513 Wed Nov 16 04:30:45 2005 +++ php-src/NEWS Wed Nov 16 06:51:51 2005 @@ -4,6 +4,7 @@ - Fixed an error in mysqli_fetch_fields (returned NULL instead of an array when row number > field_count). (Georg) - Renamed CachingRecursiveIterator to RecursiveCachingIterator. (Marcus) +- Fixed bug #35239 (Objects can lose references). (Dmitry) - Fixed bug #35229 (call_user_func() crashes when arguement_stack is nearly full). (Dmitry) - Fixed bug #35197 (Destructor is not called). (Tony) http://cvs.php.net/diff.php/ZendEngine2/zend_execute.c?r1=1.652.2.55&r2=1.652.2.56&ty=u Index: ZendEngine2/zend_execute.c diff -u ZendEngine2/zend_execute.c:1.652.2.55 ZendEngine2/zend_execute.c:1.652.2.56 --- ZendEngine2/zend_execute.c:1.652.2.55 Wed Oct 5 02:59:50 2005 +++ ZendEngine2/zend_execute.c Wed Nov 16 06:51:58 2005 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: zend_execute.c,v 1.652.2.55 2005/10/05 06:59:50 dmitry Exp $ */ +/* $Id: zend_execute.c,v 1.652.2.56 2005/11/16 11:51:58 dmitry Exp $ */ #define ZEND_INTENSIVE_DEBUGGING 0 @@ -1130,11 +1130,6 @@ return; } - - if ((type==BP_VAR_W || type==BP_VAR_RW) && container->refcount>1 && !PZVAL_IS_REF(container)) { - SEPARATE_ZVAL(container_ptr); - container = *container_ptr; - } zend_fetch_property_address_inner(container, op2, result, Ts, type TSRMLS_CC); SELECTIVE_PZVAL_LOCK(**retval, result); } http://cvs.php.net/diff.php/ZendEngine2/zend_object_handlers.c?r1=1.101.2.18&r2=1.101.2.19&ty=u Index: ZendEngine2/zend_object_handlers.c diff -u ZendEngine2/zend_object_handlers.c:1.101.2.18 ZendEngine2/zend_object_handlers.c:1.101.2.19 --- ZendEngine2/zend_object_handlers.c:1.101.2.18 Mon Jun 20 14:25:12 2005 +++ ZendEngine2/zend_object_handlers.c Wed Nov 16 06:51:59 2005 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: zend_object_handlers.c,v 1.101.2.18 2005/06/20 18:25:12 dmitry Exp $ */ +/* $Id: zend_object_handlers.c,v 1.101.2.19 2005/11/16 11:51:59 dmitry Exp $ */ #include "zend.h" #include "zend_globals.h" @@ -367,13 +367,15 @@ /* if we are assigning reference, we shouldn't move it, but instead assign variable to the same pointer */ if (PZVAL_IS_REF(*variable_ptr)) { - zval_dtor(*variable_ptr); /* old value should be destroyed */ + zval garbage = **variable_ptr; /* old value should be destroyed */ + /* To check: can't *variable_ptr be some system variable like error_zval here? */ (*variable_ptr)->type = value->type; (*variable_ptr)->value = value->value; if (value->refcount>0) { zval_copy_ctor(*variable_ptr); } + zval_dtor(&garbage); setter_done = 1; } } http://cvs.php.net/co.php/ZendEngine2/tests/bug35239.phpt?r=1.1&p=1 Index: ZendEngine2/tests/bug35239.phpt +++ ZendEngine2/tests/bug35239.phpt