Merge branch 'PHP-7.0' into PHP-7.1

2 files changed, 46 insertions, 18 deletions

diff --git a/ext/standard/array.c b/ext/standard/array.c
index ccf3ceb0f2..2e42bba9ea 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -3081,16 +3081,12 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
 				}
 				zval_ptr_dtor(&tmp);
 			} else {
-				if (Z_REFCOUNTED_P(src_entry)) {
-					Z_ADDREF_P(src_entry);
-				}
-				zend_hash_add_new(dest, string_key, src_entry);
+				zval *zv = zend_hash_add_new(dest, string_key, src_entry);
+				zval_add_ref(zv);
 			}
 		} else {
-			if (Z_REFCOUNTED_P(src_entry)) {
-				Z_ADDREF_P(src_entry);
-			}
-			zend_hash_next_index_insert_new(dest, src_entry);
+			zval *zv = zend_hash_next_index_insert_new(dest, src_entry);
+			zval_add_ref(zv);
 		}
 	} ZEND_HASH_FOREACH_END();
 	return 1;
@@ -3140,11 +3136,8 @@ PHPAPI int php_array_replace_recursive(HashTable *dest, HashTable *src) /* {{{ *
 				(Z_TYPE_P(dest_entry) != IS_ARRAY &&
 				 (!Z_ISREF_P(dest_entry) || Z_TYPE_P(Z_REFVAL_P(dest_entry)) != IS_ARRAY))) {
 
-				if (Z_REFCOUNTED_P(src_entry)) {
-					Z_ADDREF_P(src_entry);
-				}
-				zend_hash_update(dest, string_key, src_entry);
-
+				zval *zv = zend_hash_update(dest, string_key, src_entry);
+				zval_add_ref(zv);
 				continue;
 			}
 		} else {
@@ -3153,11 +3146,8 @@ PHPAPI int php_array_replace_recursive(HashTable *dest, HashTable *src) /* {{{ *
 				(Z_TYPE_P(dest_entry) != IS_ARRAY &&
 				 (!Z_ISREF_P(dest_entry) || Z_TYPE_P(Z_REFVAL_P(dest_entry)) != IS_ARRAY))) {
 
-				if (Z_REFCOUNTED_P(src_entry)) {
-					Z_ADDREF_P(src_entry);
-				}
-				zend_hash_index_update(dest, num_key, src_entry);
-
+				zval *zv = zend_hash_index_update(dest, num_key, src_entry);
+				zval_add_ref(zv);
 				continue;
 			}
 		}
diff --git a/ext/standard/tests/array/array_merge_replace_recursive_refs.phpt b/ext/standard/tests/array/array_merge_replace_recursive_refs.phpt
new file mode 100644
index 0000000000..ac8be2ba2f
--- /dev/null
+++ b/ext/standard/tests/array/array_merge_replace_recursive_refs.phpt
@@ -0,0 +1,38 @@
+--TEST--
+array_merge/replace_recursive() should unwrap references with rc=1
+--FILE--
+<?php
+
+$x = 24;
+$arr1 = [[42]];
+$arr2 = [[&$x]];
+unset($x);
+$arr3 = array_replace_recursive($arr1, $arr2);
+$arr2[0][0] = 12;
+var_dump($arr3);
+
+unset($arr1, $arr2, $arr3);
+
+$x = 24;
+$arr1 = [42];
+$arr2 = [&$x];
+unset($x);
+$arr3 = array_merge_recursive($arr1, $arr2);
+$arr2[0] = 12;
+var_dump($arr3);
+
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  array(1) {
+    [0]=>
+    int(24)
+  }
+}
+array(2) {
+  [0]=>
+  int(42)
+  [1]=>
+  int(24)
+}