cvs: ZendEngine2(PHP_5_1) / zend_execute.c zend_object_handlers.c /tests bug35239.phpt php-src NEWS

dmitry Wed Nov 16 06:52:27 2005 EDT Added files: (Branch: PHP_5_1) /ZendEngine2/tests bug35239.phpt Modified files: /php-src NEWS /ZendEngine2 zend_execute.c zend_object_handlers.c Log: Fixed bug #35239 (Objects can lose references) http://cvs.php.net/diff.php/php-src/NEWS?r1=1.2027.2.194&r2=1.2027.2.195&ty=u Index: php-src/NEWS diff -u php-src/NEWS:1.2027.2.194 php-src/NEWS:1.2027.2.195 --- php-src/NEWS:1.2027.2.194 Wed Nov 16 04:31:19 2005 +++ php-src/NEWS Wed Nov 16 06:52:25 2005 @@ -7,6 +7,7 @@ - Fixed bug in mysqli extension with unsigned int(11) being represented as signed integer in PHP instead of string in 32bit systems. (Andrey) - Fixed initializing and argument checking for posix_mknod(). (Derick) +- Fixed bug #35239 (Objects can lose references). (Dmitry) - Fixed bug #35229 (call_user_func() crashes when arguement_stack is nearly full). (Dmitry) - Fixed bug #35197 (Destructor is not called). (Tony) http://cvs.php.net/diff.php/ZendEngine2/zend_execute.c?r1=1.716.2.5&r2=1.716.2.6&ty=u Index: ZendEngine2/zend_execute.c diff -u ZendEngine2/zend_execute.c:1.716.2.5 ZendEngine2/zend_execute.c:1.716.2.6 --- ZendEngine2/zend_execute.c:1.716.2.5 Mon Oct 31 14:25:03 2005 +++ ZendEngine2/zend_execute.c Wed Nov 16 06:52:26 2005 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: zend_execute.c,v 1.716.2.5 2005/10/31 19:25:03 dmitry Exp $ */ +/* $Id: zend_execute.c,v 1.716.2.6 2005/11/16 11:52:26 dmitry Exp $ */ #define ZEND_INTENSIVE_DEBUGGING 0 @@ -1250,11 +1250,6 @@ return; } - if ((type==BP_VAR_W || type==BP_VAR_RW) && container->refcount>1 && !PZVAL_IS_REF(container)) { - SEPARATE_ZVAL(container_ptr); - container = *container_ptr; - } - if (Z_OBJ_HT_P(container)->get_property_ptr_ptr) { zval **ptr_ptr = Z_OBJ_HT_P(container)->get_property_ptr_ptr(container, prop_ptr TSRMLS_CC); if(NULL == ptr_ptr) { http://cvs.php.net/diff.php/ZendEngine2/zend_object_handlers.c?r1=1.135.2.3&r2=1.135.2.4&ty=u Index: ZendEngine2/zend_object_handlers.c diff -u ZendEngine2/zend_object_handlers.c:1.135.2.3 ZendEngine2/zend_object_handlers.c:1.135.2.4 --- ZendEngine2/zend_object_handlers.c:1.135.2.3 Tue Nov 15 08:35:22 2005 +++ ZendEngine2/zend_object_handlers.c Wed Nov 16 06:52:27 2005 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: zend_object_handlers.c,v 1.135.2.3 2005/11/15 13:35:22 dmitry Exp $ */ +/* $Id: zend_object_handlers.c,v 1.135.2.4 2005/11/16 11:52:27 dmitry Exp $ */ #include "zend.h" #include "zend_globals.h" @@ -381,13 +381,15 @@ /* if we are assigning reference, we shouldn't move it, but instead assign variable to the same pointer */ if (PZVAL_IS_REF(*variable_ptr)) { - zval_dtor(*variable_ptr); /* old value should be destroyed */ + zval garbage = **variable_ptr; /* old value should be destroyed */ + /* To check: can't *variable_ptr be some system variable like error_zval here? */ (*variable_ptr)->type = value->type; (*variable_ptr)->value = value->value; if (value->refcount>0) { zval_copy_ctor(*variable_ptr); } + zval_dtor(&garbage); setter_done = 1; } } http://cvs.php.net/co.php/ZendEngine2/tests/bug35239.phpt?r=1.1&p=1 Index: ZendEngine2/tests/bug35239.phpt +++ ZendEngine2/tests/bug35239.phpt