cvs: ZendEngine2 / zend_execute.c zend_object_handlers.c /tests bug35239.phpt

dmitry Wed Nov 16 06:52:54 2005 EDT Modified files: /ZendEngine2 zend_execute.c zend_object_handlers.c /ZendEngine2/tests bug35239.phpt Log: Fixed bug #35239 (Objects can lose references) http://cvs.php.net/diff.php/ZendEngine2/zend_execute.c?r1=1.724&r2=1.725&ty=u Index: ZendEngine2/zend_execute.c diff -u ZendEngine2/zend_execute.c:1.724 ZendEngine2/zend_execute.c:1.725 --- ZendEngine2/zend_execute.c:1.724 Mon Oct 31 14:29:45 2005 +++ ZendEngine2/zend_execute.c Wed Nov 16 06:52:53 2005 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: zend_execute.c,v 1.724 2005/10/31 19:29:45 dmitry Exp $ */ +/* $Id: zend_execute.c,v 1.725 2005/11/16 11:52:53 dmitry Exp $ */ #define ZEND_INTENSIVE_DEBUGGING 0 @@ -1352,11 +1352,6 @@ return; } - if ((type==BP_VAR_W || type==BP_VAR_RW) && container->refcount>1 && !PZVAL_IS_REF(container)) { - SEPARATE_ZVAL(container_ptr); - container = *container_ptr; - } - if (Z_OBJ_HT_P(container)->get_property_ptr_ptr) { zval **ptr_ptr = Z_OBJ_HT_P(container)->get_property_ptr_ptr(container, prop_ptr TSRMLS_CC); if (NULL == ptr_ptr) { http://cvs.php.net/diff.php/ZendEngine2/zend_object_handlers.c?r1=1.152&r2=1.153&ty=u Index: ZendEngine2/zend_object_handlers.c diff -u ZendEngine2/zend_object_handlers.c:1.152 ZendEngine2/zend_object_handlers.c:1.153 --- ZendEngine2/zend_object_handlers.c:1.152 Tue Nov 15 10:20:18 2005 +++ ZendEngine2/zend_object_handlers.c Wed Nov 16 06:52:53 2005 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: zend_object_handlers.c,v 1.152 2005/11/15 15:20:18 dmitry Exp $ */ +/* $Id: zend_object_handlers.c,v 1.153 2005/11/16 11:52:53 dmitry Exp $ */ #include "zend.h" #include "zend_globals.h" @@ -389,13 +389,15 @@ /* if we are assigning reference, we shouldn't move it, but instead assign variable to the same pointer */ if (PZVAL_IS_REF(*variable_ptr)) { - zval_dtor(*variable_ptr); /* old value should be destroyed */ + zval garbage = **variable_ptr; /* old value should be destroyed */ + /* To check: can't *variable_ptr be some system variable like error_zval here? */ (*variable_ptr)->type = value->type; (*variable_ptr)->value = value->value; if (value->refcount>0) { zval_copy_ctor(*variable_ptr); } + zval_dtor(&garbage); setter_done = 1; } } http://cvs.php.net/diff.php/ZendEngine2/tests/bug35239.phpt?r1=1.1&r2=1.2&ty=u Index: ZendEngine2/tests/bug35239.phpt diff -u /dev/null ZendEngine2/tests/bug35239.phpt:1.2 --- /dev/null Wed Nov 16 06:52:54 2005 +++ ZendEngine2/tests/bug35239.phpt Wed Nov 16 06:52:53 2005 @@ -0,0 +1,41 @@ +--TEST-- +Bug #35239 (Objects can lose references) +--FILE-- +<?php +$a = new stdClass; +$a->x0 = new stdClass; +$a->x0->y0 = 'a'; +$a->x0->y1 =& $a->x0; +$a->x0->y2 =& $a->x0; +$a->x0->y0 = 'b'; +var_dump($a); +$a->x0->y1 = "ok\n"; +echo $a->x0; +?> +--EXPECT-- +object(stdClass)#1 (1) { + ["x0"]=> + &object(stdClass)#2 (3) { + ["y0"]=> + string(1) "b" + ["y1"]=> + &object(stdClass)#2 (3) { + ["y0"]=> + string(1) "b" + ["y1"]=> + *RECURSION* + ["y2"]=> + *RECURSION* + } + ["y2"]=> + &object(stdClass)#2 (3) { + ["y0"]=> + string(1) "b" + ["y1"]=> + *RECURSION* + ["y2"]=> + *RECURSION* + } + } +} +ok