- MFH Fix refcounting

2 files changed, 50 insertions, 0 deletions

diff --git a/Zend/tests/closure_035.phpt b/Zend/tests/closure_035.phpt
new file mode 100755
index 0000000000..7fff623957
--- /dev/null
+++ b/Zend/tests/closure_035.phpt
@@ -0,0 +1,44 @@
+--TEST--
+Closure 035: Rebinding closure $this on property access
+--FILE--
+<?php
+
+$instance = 0;
+
+class Test {
+	function __construct() {
+		global $instance;
+		$this->instance = ++$instance;
+	}
+}
+
+$o = new Test;
+$o->func = function () {
+	var_dump($this);
+};
+$func = $o->func;
+$func();
+
+var_dump($instance);
+?>
+===DONE===
+--EXPECTF--
+object(Test)#%d (2) {
+  ["instance"]=>
+  int(1)
+  ["func"]=>
+  object(Closure)#%d (1) {
+    ["this"]=>
+    object(Test)#%d (2) {
+      ["instance"]=>
+      int(1)
+      ["func"]=>
+      object(Closure)#2 (1) {
+        ["this"]=>
+        *RECURSION*
+      }
+    }
+  }
+}
+int(1)
+===DONE===
\ No newline at end of file
diff --git a/Zend/zend_closures.c b/Zend/zend_closures.c
index 1f65e11668..f646550cbd 100644
--- a/Zend/zend_closures.c
+++ b/Zend/zend_closures.c
@@ -124,7 +124,13 @@ ZEND_API zval* zend_closure_copy(zval *closure_obj, zval *this_ptr TSRMLS_DC) /*
 
 	zval_copy_ctor(closure_obj);
 	closure = (zend_closure *)zend_object_store_get_object(closure_obj TSRMLS_CC);
+	if (closure->this_ptr) {
+		zval_ptr_dtor(&closure->this_ptr);
+	}
 	closure->this_ptr = this_ptr;
+	if (this_ptr) {
+		Z_ADDREF_P(this_ptr);
+	}
 	return closure_obj;
 }
 /* }}} */