Merge remote-tracking branch 'php/master'

3 files changed, 19 insertions, 3 deletions

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index 4bd8760e6a..1f7004267a 100644
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -3546,9 +3546,10 @@ ZEND_API void zend_fcall_info_args_restore(zend_fcall_info *fci, int param_count
 }
 /* }}} */
 
-ZEND_API int zend_fcall_info_args(zend_fcall_info *fci, zval *args TSRMLS_DC) /* {{{ */
+ZEND_API int zend_fcall_info_args_ex(zend_fcall_info *fci, zend_function *func, zval *args TSRMLS_DC) /* {{{ */
 {
 	zval *arg, *params;
+	int n = 1;
 
 	zend_fcall_info_args_clear(fci, !args);
 
@@ -3564,14 +3565,28 @@ ZEND_API int zend_fcall_info_args(zend_fcall_info *fci, zval *args TSRMLS_DC) /*
 	fci->params = params = (zval *) erealloc(fci->params, fci->param_count * sizeof(zval));
 
 	ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(args), arg) {
-		ZVAL_COPY(params, arg);
+		if (func && !Z_ISREF_P(arg) && ARG_SHOULD_BE_SENT_BY_REF(func, n)) {
+			ZVAL_NEW_REF(params, arg);
+			if (Z_REFCOUNTED_P(arg)) {
+				Z_ADDREF_P(arg);
+			}
+		} else {
+			ZVAL_COPY(params, arg);
+		}
 		params++;
+		n++;
 	} ZEND_HASH_FOREACH_END();
 
 	return SUCCESS;
 }
 /* }}} */
 
+ZEND_API int zend_fcall_info_args(zend_fcall_info *fci, zval *args TSRMLS_DC) /* {{{ */
+{
+	return zend_fcall_info_args_ex(fci, NULL, args TSRMLS_CC);
+}
+/* }}} */
+
 ZEND_API int zend_fcall_info_argp(zend_fcall_info *fci TSRMLS_DC, int argc, zval *argv) /* {{{ */
 {
 	int i;
diff --git a/Zend/zend_API.h b/Zend/zend_API.h
index 0f8c490f30..7f61431e2f 100644
--- a/Zend/zend_API.h
+++ b/Zend/zend_API.h
@@ -491,6 +491,7 @@ ZEND_API void zend_fcall_info_args_restore(zend_fcall_info *fci, int param_count
  * refcount. If args is NULL and arguments are set then those are cleared.
  */
 ZEND_API int zend_fcall_info_args(zend_fcall_info *fci, zval *args TSRMLS_DC);
+ZEND_API int zend_fcall_info_args_ex(zend_fcall_info *fci, zend_function *func, zval *args TSRMLS_DC);
 
 /** Set arguments in the zend_fcall_info struct taking care of refcount.
  * If argc is 0 the arguments which are set will be cleared, else pass
diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c
index 7d840a2a3f..8db5f43161 100644
--- a/ext/pdo/pdo_stmt.c
+++ b/ext/pdo/pdo_stmt.c
@@ -748,7 +748,7 @@ static int do_fetch_class_prepare(pdo_stmt_t *stmt TSRMLS_DC) /* {{{ */
 		fci->params = NULL;
 		fci->no_separation = 1;
 
-		zend_fcall_info_args(fci, &stmt->fetch.cls.ctor_args TSRMLS_CC);
+		zend_fcall_info_args_ex(fci, ce->constructor, &stmt->fetch.cls.ctor_args TSRMLS_CC);
 
 		fcc->initialized = 1;
 		fcc->function_handler = ce->constructor;