diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2018-01-09 20:24:25 +0100 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2018-01-09 20:24:48 +0100 |
| commit | 2dd80a078251273cdfd8d8fda71651e5ecc40040 (patch) | |
| tree | 4dc3bf70bfd92b202950e231a9dfeac963afe004 | |
| parent | c8eda195aa3e28e3e54be0bf749cb12e5b51132d (diff) | |
| parent | fd30c59e041eb4ccaabb2099bb3be15a55e2988d (diff) | |
| download | php-git-2dd80a078251273cdfd8d8fda71651e5ecc40040.tar.gz | |
Merge branch 'PHP-7.1' into PHP-7.2
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | Zend/tests/bug75786.phpt | 18 | ||||
| -rw-r--r-- | Zend/zend_vm_def.h | 7 | ||||
| -rw-r--r-- | Zend/zend_vm_execute.h | 7 |
4 files changed, 24 insertions, 10 deletions
@@ -7,6 +7,8 @@ PHP NEWS (Laruence) . Fixed bug #75679 (Path 260 character problem). (Anatol) . Fixed bug #75614 (Some non-portable == in shell scripts). (jdolecek) + . Fixed bug #75786 (segfault when using spread operator on generator passed + by reference). (Nikita) - Opcache: . Fixed bug #75687 (var 8 (TMP) has array key type but not value type). diff --git a/Zend/tests/bug75786.phpt b/Zend/tests/bug75786.phpt new file mode 100644 index 0000000000..b93111b9e3 --- /dev/null +++ b/Zend/tests/bug75786.phpt @@ -0,0 +1,18 @@ +--TEST-- +Bug #75786: segfault when using spread operator on generator passed by reference +--FILE-- +<?php + +function &gen($items) { + foreach ($items as $key => &$value) { + yield $key => $value; + } +} + +var_dump(...gen(['a', 'b', 'c'])); + +?> +--EXPECT-- +string(1) "a" +string(1) "b" +string(1) "c" diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index 3502cb02b6..7eb91efe8b 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -4468,11 +4468,8 @@ ZEND_VM_C_LABEL(send_again): ); } - if (Z_ISREF_P(arg)) { - ZVAL_DUP(arg, Z_REFVAL_P(arg)); - } else { - if (Z_REFCOUNTED_P(arg)) Z_ADDREF_P(arg); - } + ZVAL_DEREF(arg); + Z_TRY_ADDREF_P(arg); zend_vm_stack_extend_call_frame(&EX(call), arg_num - 1, 1); top = ZEND_CALL_ARG(EX(call), arg_num); diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index 997fc78bdf..d8eb5a5743 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -1291,11 +1291,8 @@ send_again: ); } - if (Z_ISREF_P(arg)) { - ZVAL_DUP(arg, Z_REFVAL_P(arg)); - } else { - if (Z_REFCOUNTED_P(arg)) Z_ADDREF_P(arg); - } + ZVAL_DEREF(arg); + Z_TRY_ADDREF_P(arg); zend_vm_stack_extend_call_frame(&EX(call), arg_num - 1, 1); top = ZEND_CALL_ARG(EX(call), arg_num); |