diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2017-03-10 18:21:09 +0100 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2017-03-10 18:21:09 +0100 |
| commit | 22e6b5ef220345bb187c93a293ee436a80f897d1 (patch) | |
| tree | 469b9ababa601f3a3e549b49303ab8d4d11376c5 | |
| parent | ec31924cd68df4f5591664d487baaba0d01b1daf (diff) | |
| parent | 280e8dafe472e6789fdcfebd3dade4c0705b0134 (diff) | |
| download | php-git-22e6b5ef220345bb187c93a293ee436a80f897d1.tar.gz | |
Merge branch 'PHP-7.1'
| -rw-r--r-- | Zend/tests/bug73960.phpt | 16 | ||||
| -rw-r--r-- | Zend/zend_execute.h | 4 |
2 files changed, 20 insertions, 0 deletions
diff --git a/Zend/tests/bug73960.phpt b/Zend/tests/bug73960.phpt new file mode 100644 index 0000000000..533c87afb0 --- /dev/null +++ b/Zend/tests/bug73960.phpt @@ -0,0 +1,16 @@ +--TEST-- +Bug #73960: Leak with instance method calling static method with referenced return +--FILE-- +<?php + +$value = 'one'; +$array = array($value); +$array = $ref =& $array; +var_dump($array); + +?> +--EXPECT-- +array(1) { + [0]=> + string(3) "one" +} diff --git a/Zend/zend_execute.h b/Zend/zend_execute.h index 554ad28bb7..5f0caf6b61 100644 --- a/Zend/zend_execute.h +++ b/Zend/zend_execute.h @@ -81,6 +81,10 @@ static zend_always_inline zval* zend_assign_to_variable(zval *variable_ptr, zval return variable_ptr; } if (ZEND_CONST_COND(value_type & (IS_VAR|IS_CV), 1) && variable_ptr == value) { + if (value_type == IS_VAR && ref) { + ZEND_ASSERT(GC_REFCOUNT(ref) > 1); + --GC_REFCOUNT(ref); + } return variable_ptr; } garbage = Z_COUNTED_P(variable_ptr); |