Merge branch 'PHP-5.6'

* PHP-5.6:
  More fixes for nodelist array access
  - testing for null property read
  - no zval copying if the type is already long
  - memory fix for master
  - use zend_long for offset

Conflicts:
	ext/dom/php_dom.c

2 files changed, 36 insertions, 17 deletions

diff --git a/ext/dom/php_dom.c b/ext/dom/php_dom.c
index 71c06612db..c25cbaba58 100644
--- a/ext/dom/php_dom.c
+++ b/ext/dom/php_dom.c
@@ -1552,8 +1552,7 @@ zval *dom_nodelist_read_dimension(zval *object, zval *offset, int type, zval *rv
 		return NULL;
 	}
 
-	ZVAL_COPY(&offset_copy, offset);
-	convert_to_long(&offset_copy);
+	ZVAL_LONG(&offset_copy, zval_get_long(offset));
 
 	zend_call_method_with_1_params(object, Z_OBJCE_P(object), NULL, "item", rv, &offset_copy);
 
@@ -1562,21 +1561,15 @@ zval *dom_nodelist_read_dimension(zval *object, zval *offset, int type, zval *rv
 
 int dom_nodelist_has_dimension(zval *object, zval *member, int check_empty TSRMLS_DC)
 {
-	zval *length, offset_copy;
-	int ret;
-
-	ZVAL_COPY(&offset_copy, member);
-	convert_to_long(&offset_copy);
+	zend_long offset = zval_get_long(member);
 
-	if (Z_LVAL(offset_copy) < 0) {
+	if (offset < 0) {
 		return 0;
-	}
-
-	length = zend_read_property(Z_OBJCE_P(object), object, "length", sizeof("length") - 1, 0 TSRMLS_CC);
-
-	ret = Z_LVAL(offset_copy) < Z_LVAL_P(length);
+	} else {
+		zval *length = zend_read_property(Z_OBJCE_P(object), object, "length", sizeof("length") - 1, 0 TSRMLS_CC);
 
-	return ret;
+		return length && offset < Z_LVAL_P(length);
+	}
 } /* }}} end dom_nodelist_has_dimension */
 
 #endif /* HAVE_DOM */
diff --git a/ext/dom/tests/bug67949.phpt b/ext/dom/tests/bug67949.phpt
index fc29881ca7..e4eb6f724f 100644
--- a/ext/dom/tests/bug67949.phpt
+++ b/ext/dom/tests/bug67949.phpt
@@ -22,11 +22,21 @@ var_dump($nodes[0]->textContent);
 var_dump($nodes[1]->textContent);
 
 echo "testing offset not a long\n";
-$offset = 'test';
+$offset = ['test'];
+var_dump($offset);
+var_dump(isset($nodes[$offset]), $nodes[$offset]->textContent);
+var_dump($offset);
+
+$something = 'test';
+$offset = &$something;
+
+var_dump($offset);
+var_dump(isset($nodes[$offset]), $nodes[$offset]->textContent);
 var_dump($offset);
-var_dump($nodes[$offset]->textContent);
+
+$offset = 'test';
 var_dump($offset);
-var_dump(isset($nodes[$offset]));
+var_dump(isset($nodes[$offset]), $nodes[$offset]->textContent);
 var_dump($offset);
 
 echo "testing read_dimension with null offset\n";
@@ -49,13 +59,29 @@ string(4) "data"
 Notice: Trying to get property of non-object in %s on line %d
 NULL
 testing offset not a long
+array(1) {
+  [0]=>
+  string(4) "test"
+}
+
+Notice: Trying to get property of non-object in %s on line %d
+bool(false)
+NULL
+array(1) {
+  [0]=>
+  string(4) "test"
+}
 string(4) "test"
+bool(true)
 string(4) "data"
 string(4) "test"
+string(4) "test"
 bool(true)
+string(4) "data"
 string(4) "test"
 testing read_dimension with null offset
 NULL
 testing attribute access
 string(4) "href"
 ==DONE==
+