Fix class constant fetching

If a class is extended after the constant fetch has been cached
the cached value will be turned into a reference. On the next
fetch the polymorphic cache will return this reference, which
will be directly returned. The object assignment code then
dereferences this result and performs a shallow copy, which is
invalid for references. This subsequently leads to the constant
value being prematurely freed.

This is fixed by dereferencing the value returned from the
polymorphic cache. Furthermore the incorrect dereference from
in the object assignment code is replaced with an assertion that
we're dealing with a non-reference, so ensure that this kind of
problem cannot go unnoticed in the future.

1 files changed, 31 insertions, 0 deletions

diff --git a/Zend/tests/class_constant_to_reference_cached.phpt b/Zend/tests/class_constant_to_reference_cached.phpt
new file mode 100644
index 0000000000..b752226aba
--- /dev/null
+++ b/Zend/tests/class_constant_to_reference_cached.phpt
@@ -0,0 +1,31 @@
+--TEST--
+Conversion of a class constant to a reference after it has been cached
+--FILE--
+<?php
+
+class Test {
+    const TEST = 'TEST';
+
+    private $prop;
+
+    public function readConst() {
+        $this->prop = self::TEST;
+    }
+}
+
+$obj = new Test;
+$obj->readConst();
+unset($obj);
+var_dump(Test::TEST);
+
+eval('class Test2 extends Test {}');
+
+$obj = new Test;
+$obj->readConst();
+unset($obj);
+var_dump(Test::TEST);
+
+?>
+--EXPECT--
+string(4) "TEST"
+string(4) "TEST"