diff options
| -rw-r--r-- | NEWS | 1 | ||||
| -rwxr-xr-x | Zend/tests/bug34518.phpt | 38 | ||||
| -rw-r--r-- | Zend/zend_vm_def.h | 16 | ||||
| -rw-r--r-- | Zend/zend_vm_execute.h | 160 |
4 files changed, 193 insertions, 22 deletions
@@ -29,6 +29,7 @@ PHP NEWS - Fixed "make test" to work for phpized extensions. (Hartmut, Jani) - Fixed failing queries (FALSE returned) with mysqli_query() on 64 bit systems. (Andrey) +- Fixed bug #34518 (Unset doesn't separate container in CV). (Dmitry) - Fixed bug #34456 (Possible crash inside pspell extension). (Nuno) - Fixed bug #34450 (Segfault when calling mysqli_close() in destructor). (Tony) - Fixed bug #34449 (ext/soap: XSD_ANYXML functionality not exposed). (Dmitry) diff --git a/Zend/tests/bug34518.phpt b/Zend/tests/bug34518.phpt new file mode 100755 index 0000000000..b94fdf4981 --- /dev/null +++ b/Zend/tests/bug34518.phpt @@ -0,0 +1,38 @@ +--TEST-- +Bug #34518 (Unset doesn't separate container in CV) +--FILE-- +<?php +$arr = array(1,2,3); +$arr["foo"] = array(4,5,6); +$copy = $arr; + +unset($copy["foo"][0]); +print_r($arr); +print_r($copy); +?> +--EXPECT-- +Array +( + [0] => 1 + [1] => 2 + [2] => 3 + [foo] => Array + ( + [0] => 4 + [1] => 5 + [2] => 6 + ) + +) +Array +( + [0] => 1 + [1] => 2 + [2] => 3 + [foo] => Array + ( + [1] => 5 + [2] => 6 + ) + +) diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index 11a50e70f2..d0744b309c 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -1096,6 +1096,7 @@ ZEND_VM_HANDLER(96, ZEND_FETCH_DIM_UNSET, VAR|CV, CONST|TMP|VAR|CV) { zend_op *opline = EX(opline); zend_free_op free_op1, free_op2; + zval **container = GET_OP1_ZVAL_PTR_PTR(BP_VAR_UNSET); zval *dim = GET_OP2_ZVAL_PTR(BP_VAR_R); /* Not needed in DIM_UNSET @@ -1103,7 +1104,12 @@ ZEND_VM_HANDLER(96, ZEND_FETCH_DIM_UNSET, VAR|CV, CONST|TMP|VAR|CV) PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); } */ - zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), GET_OP1_ZVAL_PTR_PTR(BP_VAR_UNSET), dim, IS_OP2_TMP_FREE(), BP_VAR_UNSET TSRMLS_CC); + if (OP1_TYPE == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } + zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, dim, IS_OP2_TMP_FREE(), BP_VAR_UNSET TSRMLS_CC); FREE_OP2(); FREE_OP1_VAR_PTR(); if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) { @@ -1261,12 +1267,18 @@ ZEND_VM_HANDLER(97, ZEND_FETCH_OBJ_UNSET, VAR|UNUSED|CV, CONST|TMP|VAR|CV) { zend_op *opline = EX(opline); zend_free_op free_op1, free_op2, free_res; + zval **container = GET_OP1_OBJ_ZVAL_PTR_PTR(BP_VAR_R); zval *property = GET_OP2_ZVAL_PTR(BP_VAR_R); + if (OP1_TYPE == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } if (IS_OP2_TMP_FREE()) { MAKE_REAL_ZVAL_PTR(property); } - zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), GET_OP1_OBJ_ZVAL_PTR_PTR(BP_VAR_R), property, BP_VAR_R TSRMLS_CC); + zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, property, BP_VAR_R TSRMLS_CC); if (IS_OP2_TMP_FREE()) { zval_ptr_dtor(&property); } else { diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index fe5b2591be..fd20c1fcd6 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -8548,6 +8548,7 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); zend_free_op free_op1; + zval **container = _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC); zval *dim = &opline->op2.u.constant; /* Not needed in DIM_UNSET @@ -8555,7 +8556,12 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS) PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); } */ - zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC), dim, 0, BP_VAR_UNSET TSRMLS_CC); + if (IS_VAR == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } + zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, dim, 0, BP_VAR_UNSET TSRMLS_CC); if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) { @@ -8713,12 +8719,18 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); zend_free_op free_op1, free_res; + zval **container = _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC); zval *property = &opline->op2.u.constant; + if (IS_VAR == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } if (0) { MAKE_REAL_ZVAL_PTR(property); } - zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC), property, BP_VAR_R TSRMLS_CC); + zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, property, BP_VAR_R TSRMLS_CC); if (0) { zval_ptr_dtor(&property); } else { @@ -9968,6 +9980,7 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); zend_free_op free_op1, free_op2; + zval **container = _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC); zval *dim = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); /* Not needed in DIM_UNSET @@ -9975,7 +9988,12 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS) PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); } */ - zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC), dim, 1, BP_VAR_UNSET TSRMLS_CC); + if (IS_VAR == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } + zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, dim, 1, BP_VAR_UNSET TSRMLS_CC); zval_dtor(free_op2.var); if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) { @@ -10133,12 +10151,18 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); zend_free_op free_op1, free_op2, free_res; + zval **container = _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC); zval *property = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); + if (IS_VAR == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } if (1) { MAKE_REAL_ZVAL_PTR(property); } - zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC), property, BP_VAR_R TSRMLS_CC); + zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, property, BP_VAR_R TSRMLS_CC); if (1) { zval_ptr_dtor(&property); } else { @@ -11391,6 +11415,7 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); zend_free_op free_op1, free_op2; + zval **container = _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC); zval *dim = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); /* Not needed in DIM_UNSET @@ -11398,7 +11423,12 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS) PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); } */ - zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC), dim, 0, BP_VAR_UNSET TSRMLS_CC); + if (IS_VAR == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } + zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, dim, 0, BP_VAR_UNSET TSRMLS_CC); if (free_op2.var) {zval_ptr_dtor(&free_op2.var);}; if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) { @@ -11556,12 +11586,18 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); zend_free_op free_op1, free_op2, free_res; + zval **container = _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC); zval *property = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); + if (IS_VAR == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } if (0) { MAKE_REAL_ZVAL_PTR(property); } - zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC), property, BP_VAR_R TSRMLS_CC); + zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, property, BP_VAR_R TSRMLS_CC); if (0) { zval_ptr_dtor(&property); } else { @@ -13259,6 +13295,7 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); zend_free_op free_op1; + zval **container = _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC); zval *dim = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC); /* Not needed in DIM_UNSET @@ -13266,7 +13303,12 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS) PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); } */ - zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC), dim, 0, BP_VAR_UNSET TSRMLS_CC); + if (IS_VAR == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } + zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, dim, 0, BP_VAR_UNSET TSRMLS_CC); if (free_op1.var) {zval_ptr_dtor(&free_op1.var);}; if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) { @@ -13424,12 +13466,18 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); zend_free_op free_op1, free_res; + zval **container = _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC); zval *property = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC); + if (IS_VAR == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } if (0) { MAKE_REAL_ZVAL_PTR(property); } - zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_var(&opline->op1, EX(Ts), &free_op1 TSRMLS_CC), property, BP_VAR_R TSRMLS_CC); + zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, property, BP_VAR_R TSRMLS_CC); if (0) { zval_ptr_dtor(&property); } else { @@ -14620,12 +14668,18 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_AR { zend_op *opline = EX(opline); zend_free_op free_res; + zval **container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C); zval *property = &opline->op2.u.constant; + if (IS_UNUSED == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } if (0) { MAKE_REAL_ZVAL_PTR(property); } - zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_obj_zval_ptr_ptr_unused(TSRMLS_C), property, BP_VAR_R TSRMLS_CC); + zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, property, BP_VAR_R TSRMLS_CC); if (0) { zval_ptr_dtor(&property); } else { @@ -15699,12 +15753,18 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS { zend_op *opline = EX(opline); zend_free_op free_op2, free_res; + zval **container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C); zval *property = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); + if (IS_UNUSED == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } if (1) { MAKE_REAL_ZVAL_PTR(property); } - zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_obj_zval_ptr_ptr_unused(TSRMLS_C), property, BP_VAR_R TSRMLS_CC); + zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, property, BP_VAR_R TSRMLS_CC); if (1) { zval_ptr_dtor(&property); } else { @@ -16739,12 +16799,18 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS { zend_op *opline = EX(opline); zend_free_op free_op2, free_res; + zval **container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C); zval *property = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); + if (IS_UNUSED == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } if (0) { MAKE_REAL_ZVAL_PTR(property); } - zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_obj_zval_ptr_ptr_unused(TSRMLS_C), property, BP_VAR_R TSRMLS_CC); + zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, property, BP_VAR_R TSRMLS_CC); if (0) { zval_ptr_dtor(&property); } else { @@ -18144,12 +18210,18 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); zend_free_op free_res; + zval **container = _get_obj_zval_ptr_ptr_unused(TSRMLS_C); zval *property = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC); + if (IS_UNUSED == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } if (0) { MAKE_REAL_ZVAL_PTR(property); } - zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_obj_zval_ptr_ptr_unused(TSRMLS_C), property, BP_VAR_R TSRMLS_CC); + zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, property, BP_VAR_R TSRMLS_CC); if (0) { zval_ptr_dtor(&property); } else { @@ -20488,6 +20560,7 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); + zval **container = _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), BP_VAR_UNSET TSRMLS_CC); zval *dim = &opline->op2.u.constant; /* Not needed in DIM_UNSET @@ -20495,7 +20568,12 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS) PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); } */ - zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), BP_VAR_UNSET TSRMLS_CC), dim, 0, BP_VAR_UNSET TSRMLS_CC); + if (IS_CV == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } + zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, dim, 0, BP_VAR_UNSET TSRMLS_CC); if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) { @@ -20652,12 +20730,18 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); zend_free_op free_res; + zval **container = _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), BP_VAR_R TSRMLS_CC); zval *property = &opline->op2.u.constant; + if (IS_CV == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } if (0) { MAKE_REAL_ZVAL_PTR(property); } - zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), BP_VAR_R TSRMLS_CC), property, BP_VAR_R TSRMLS_CC); + zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, property, BP_VAR_R TSRMLS_CC); if (0) { zval_ptr_dtor(&property); } else { @@ -21900,6 +21984,7 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); zend_free_op free_op2; + zval **container = _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), BP_VAR_UNSET TSRMLS_CC); zval *dim = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); /* Not needed in DIM_UNSET @@ -21907,7 +21992,12 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS) PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); } */ - zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), BP_VAR_UNSET TSRMLS_CC), dim, 1, BP_VAR_UNSET TSRMLS_CC); + if (IS_CV == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } + zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, dim, 1, BP_VAR_UNSET TSRMLS_CC); zval_dtor(free_op2.var); if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) { @@ -22064,12 +22154,18 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); zend_free_op free_op2, free_res; + zval **container = _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), BP_VAR_R TSRMLS_CC); zval *property = _get_zval_ptr_tmp(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); + if (IS_CV == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } if (1) { MAKE_REAL_ZVAL_PTR(property); } - zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), BP_VAR_R TSRMLS_CC), property, BP_VAR_R TSRMLS_CC); + zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, property, BP_VAR_R TSRMLS_CC); if (1) { zval_ptr_dtor(&property); } else { @@ -23315,6 +23411,7 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); zend_free_op free_op2; + zval **container = _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), BP_VAR_UNSET TSRMLS_CC); zval *dim = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); /* Not needed in DIM_UNSET @@ -23322,7 +23419,12 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS) PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); } */ - zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), BP_VAR_UNSET TSRMLS_CC), dim, 0, BP_VAR_UNSET TSRMLS_CC); + if (IS_CV == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } + zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, dim, 0, BP_VAR_UNSET TSRMLS_CC); if (free_op2.var) {zval_ptr_dtor(&free_op2.var);}; if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) { @@ -23479,12 +23581,18 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); zend_free_op free_op2, free_res; + zval **container = _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), BP_VAR_R TSRMLS_CC); zval *property = _get_zval_ptr_var(&opline->op2, EX(Ts), &free_op2 TSRMLS_CC); + if (IS_CV == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } if (0) { MAKE_REAL_ZVAL_PTR(property); } - zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), BP_VAR_R TSRMLS_CC), property, BP_VAR_R TSRMLS_CC); + zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, property, BP_VAR_R TSRMLS_CC); if (0) { zval_ptr_dtor(&property); } else { @@ -25173,6 +25281,7 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); + zval **container = _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), BP_VAR_UNSET TSRMLS_CC); zval *dim = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC); /* Not needed in DIM_UNSET @@ -25180,7 +25289,12 @@ static int ZEND_FETCH_DIM_UNSET_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS) PZVAL_LOCK(*EX_T(opline->op1.u.var).var.ptr_ptr); } */ - zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), BP_VAR_UNSET TSRMLS_CC), dim, 0, BP_VAR_UNSET TSRMLS_CC); + if (IS_CV == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } + zend_fetch_dimension_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, dim, 0, BP_VAR_UNSET TSRMLS_CC); if (EX_T(opline->result.u.var).var.ptr_ptr == NULL) { @@ -25337,12 +25451,18 @@ static int ZEND_FETCH_OBJ_UNSET_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS) { zend_op *opline = EX(opline); zend_free_op free_res; + zval **container = _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), BP_VAR_R TSRMLS_CC); zval *property = _get_zval_ptr_cv(&opline->op2, EX(Ts), BP_VAR_R TSRMLS_CC); + if (IS_CV == IS_CV) { + if (container != &EG(uninitialized_zval_ptr)) { + SEPARATE_ZVAL_IF_NOT_REF(container); + } + } if (0) { MAKE_REAL_ZVAL_PTR(property); } - zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), _get_zval_ptr_ptr_cv(&opline->op1, EX(Ts), BP_VAR_R TSRMLS_CC), property, BP_VAR_R TSRMLS_CC); + zend_fetch_property_address(RETURN_VALUE_UNUSED(&opline->result)?NULL:&EX_T(opline->result.u.var), container, property, BP_VAR_R TSRMLS_CC); if (0) { zval_ptr_dtor(&property); } else { |