Deref names returned by __sleep()

2 files changed, 19 insertions, 0 deletions

diff --git a/ext/standard/tests/serialize/sleep_deref.phpt b/ext/standard/tests/serialize/sleep_deref.phpt
new file mode 100644
index 0000000000..36777db0a3
--- /dev/null
+++ b/ext/standard/tests/serialize/sleep_deref.phpt
@@ -0,0 +1,18 @@
+--TEST--
+__sleep() can return references
+--FILE--
+<?php
+
+class Test {
+    public $x = 42;
+    public function __sleep() {
+        $name = 'x';
+        return [&$name];
+    }
+}
+
+var_dump(serialize(new Test));
+
+?>
+--EXPECT--
+string(28) "O:4:"Test":1:{s:1:"x";i:42;}"
diff --git a/ext/standard/var.c b/ext/standard/var.c
index a2eb471d54..aafc35e8bf 100644
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -778,6 +778,7 @@ static void php_var_serialize_collect_names(HashTable *ht, HashTable *src) /* {{
 
 	zend_hash_init(ht, zend_hash_num_elements(src), NULL, NULL, 0);
 	ZEND_HASH_FOREACH_VAL(src, val) {
+		ZVAL_DEREF(val);
 		if (Z_TYPE_P(val) != IS_STRING) {
 			php_error_docref(NULL, E_NOTICE,
 					"__sleep should return an array only containing the names of instance-variables to serialize.");