diff options
| author | Dmitry Stogov <dmitry@php.net> | 2006-10-03 09:05:14 +0000 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@php.net> | 2006-10-03 09:05:14 +0000 |
| commit | 9875fe44e21cb98a274e1b8d0938ff1e13888012 (patch) | |
| tree | 498ddfc3d0958050bc6f65ee90d5cc1cbf6bc376 | |
| parent | 62127575952c72a3c334a37b40265aa6af279767 (diff) | |
| download | php-git-9875fe44e21cb98a274e1b8d0938ff1e13888012.tar.gz | |
Fixed bug #39017 (foreach(($obj = new myClass) as $v); echo $obj; segfaults)
| -rw-r--r-- | NEWS | 2 | ||||
| -rwxr-xr-x | Zend/tests/bug39017.phpt | 11 | ||||
| -rw-r--r-- | Zend/zend_vm_def.h | 3 | ||||
| -rw-r--r-- | Zend/zend_vm_execute.h | 12 |
4 files changed, 28 insertions, 0 deletions
@@ -6,6 +6,8 @@ PHP NEWS - Fixed mess with CGI/CLI -d option (now it works with cgi; constants are working exactly like in php.ini; with FastCGI -d affects all requests). (Dmitry) +- Fixed bug #39017 (foreach(($obj = new myClass) as $v); echo $obj; segfaults). + (Dmitry) - Fixed bug #39004 (Fixed generation of config.nice with autoconf 2.60). (Ilia) - Fixed bug #39003 (__autoload() is called for type hinting). (Dmitry, Tony) diff --git a/Zend/tests/bug39017.phpt b/Zend/tests/bug39017.phpt new file mode 100755 index 0000000000..70204758d5 --- /dev/null +++ b/Zend/tests/bug39017.phpt @@ -0,0 +1,11 @@ +--TEST-- +Bug #39017 (foreach(($obj = new myClass) as $v); echo $obj; segfaults) +--FILE-- +<?php +class A {} +foreach(($a=(object)new A()) as $v); +var_dump($a); // UNKNOWN:0 +?> +--EXPECTF-- +object(A)#%d (0) { +} diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index 074a48ea99..ef44ed108a 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -3106,6 +3106,9 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY) array_ptr = tmp; } else if (Z_TYPE_P(array_ptr) == IS_OBJECT) { ce = Z_OBJCE_P(array_ptr); + if (!ce || !ce->get_iterator) { + array_ptr->refcount++; + } } else { if (OP1_TYPE == IS_VAR && free_op1.var == NULL && diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index aff983bd26..f23e6ab835 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -2165,6 +2165,9 @@ static int ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS) array_ptr = tmp; } else if (Z_TYPE_P(array_ptr) == IS_OBJECT) { ce = Z_OBJCE_P(array_ptr); + if (!ce || !ce->get_iterator) { + array_ptr->refcount++; + } } else { if (IS_CONST == IS_VAR && free_op1.var == NULL && @@ -4701,6 +4704,9 @@ static int ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS) array_ptr = tmp; } else if (Z_TYPE_P(array_ptr) == IS_OBJECT) { ce = Z_OBJCE_P(array_ptr); + if (!ce || !ce->get_iterator) { + array_ptr->refcount++; + } } else { if (IS_TMP_VAR == IS_VAR && free_op1.var == NULL && @@ -7819,6 +7825,9 @@ static int ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS) array_ptr = tmp; } else if (Z_TYPE_P(array_ptr) == IS_OBJECT) { ce = Z_OBJCE_P(array_ptr); + if (!ce || !ce->get_iterator) { + array_ptr->refcount++; + } } else { if (IS_VAR == IS_VAR && free_op1.var == NULL && @@ -19853,6 +19862,9 @@ static int ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS) array_ptr = tmp; } else if (Z_TYPE_P(array_ptr) == IS_OBJECT) { ce = Z_OBJCE_P(array_ptr); + if (!ce || !ce->get_iterator) { + array_ptr->refcount++; + } } else { if (IS_CV == IS_VAR && free_op1.var == NULL && |