3 files changed, 27 insertions, 14 deletions

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 159bca5b4f..04ca8dcb86 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -857,8 +857,8 @@ static void zend_fetch_property_address(znode *result, znode *op1, znode *op2, t
 	}
 
 	if (container->type == IS_OBJECT &&
-		(type == BP_VAR_W && Z_OBJCE_P(container)->handle_property_set ||
-		 type != BP_VAR_W && Z_OBJCE_P(container)->handle_property_get)) {
+		((type == BP_VAR_W && Z_OBJCE_P(container)->handle_property_set) ||
+		 (type != BP_VAR_W && Z_OBJCE_P(container)->handle_property_get))) {
 		zend_overloaded_element overloaded_element;
 
 		Ts[result->u.var].EA.data.overloaded_element.object = container;
diff --git a/Zend/zend_llist.c b/Zend/zend_llist.c
index e3e4945fb5..bca13a6f1f 100644
--- a/Zend/zend_llist.c
+++ b/Zend/zend_llist.c
@@ -64,32 +64,34 @@ ZEND_API void zend_llist_prepend_element(zend_llist *l, void *element)
 
 
 #define DEL_LLIST_ELEMENT(current, l) \
-			if (current->prev) {\
-				current->prev->next = current->next;\
+			if ((current)->prev) {\
+				(current)->prev->next = (current)->next;\
 			} else {\
-				l->head = current->next;\
+				(l)->head = (current)->next;\
 			}\
-			if (current->next) {\
-				current->next->prev = current->prev;\
+			if ((current)->next) {\
+				(current)->next->prev = (current)->prev;\
 			} else {\
-				l->tail = current->prev;\
+				(l)->tail = (current)->prev;\
 			}\
-			if (l->dtor) {\
-				l->dtor(current->data);\
-				pefree(current, l->persistent);\
+			if ((l)->dtor) {\
+				(l)->dtor((current)->data);\
+				pefree((current), (l)->persistent);\
 			}
 
 
 ZEND_API void zend_llist_del_element(zend_llist *l, void *element, int (*compare)(void *element1, void *element2))
 {
 	zend_llist_element *current=l->head;
+	zend_llist_element *next;
 
 	while (current) {
+		next = current->next;
 		if (compare(current->data, element)) {
 			DEL_LLIST_ELEMENT(current, l);
 			break;
 		}
-		current = current->next;
+		current = next;
 	}
 }
 
@@ -116,17 +118,28 @@ ZEND_API void zend_llist_clean(zend_llist *l)
 }
 
 
-ZEND_API void zend_llist_remove_tail(zend_llist *l)
+ZEND_API void *zend_llist_remove_tail(zend_llist *l)
 {
 	zend_llist_element *old_tail;
+	void *data;
 
 	if ((old_tail = l->tail)) {
 		if (l->tail->prev) {
 			l->tail->prev->next = NULL;
 		}
+        
+		/* Save the data, this doesn't get free'd, 
+		 * the pointer is just removed from the list
+		 */
+		data = old_tail->data;
+
 		l->tail = l->tail->prev;
 		pefree(old_tail, l->persistent);
+
+		return data;
 	}
+
+	return NULL;
 }
 
 
diff --git a/Zend/zend_llist.h b/Zend/zend_llist.h
index 63bf647483..638e464ef0 100644
--- a/Zend/zend_llist.h
+++ b/Zend/zend_llist.h
@@ -53,7 +53,7 @@ ZEND_API void zend_llist_prepend_element(zend_llist *l, void *element);
 ZEND_API void zend_llist_del_element(zend_llist *l, void *element, int (*compare)(void *element1, void *element2));
 ZEND_API void zend_llist_destroy(zend_llist *l);
 ZEND_API void zend_llist_clean(zend_llist *l);
-ZEND_API void zend_llist_remove_tail(zend_llist *l);
+ZEND_API void *zend_llist_remove_tail(zend_llist *l);
 ZEND_API void zend_llist_copy(zend_llist *dst, zend_llist *src);
 ZEND_API void zend_llist_apply(zend_llist *l, llist_apply_func_t func TSRMLS_DC);
 ZEND_API void zend_llist_apply_with_del(zend_llist *l, int (*func)(void *data));