| Dmitry Stogov 2005-11-16, 7:55 am |
| dmitry Wed Nov 16 06:52:27 2005 EDT
Added files: (Branch: PHP_5_1)
/ZendEngine2/tests bug35239.phpt
Modified files:
/php-src NEWS
/ZendEngine2 zend_execute.c zend_object_handlers.c
Log:
Fixed bug #35239 (Objects can lose references)
http://cvs.php.net/diff.php/php-src...2027.2.195&ty=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.2027.2.194 php-src/NEWS:1.2027.2.195
--- php-src/NEWS:1.2027.2.194 Wed Nov 16 04:31:19 2005
+++ php-src/NEWS Wed Nov 16 06:52:25 2005
@@ -7,6 +7,7 @@
- Fixed bug in mysqli extension with unsigned int(11) being represented as
signed integer in PHP instead of string in 32bit systems. (Andrey)
- Fixed initializing and argument checking for posix_mknod(). (Derick)
+- Fixed bug #35239 (Objects can lose references). (Dmitry)
- Fixed bug #35229 (call_user_func() crashes when arguement_stack is nearly
full). (Dmitry)
- Fixed bug #35197 (Destructor is not called). (Tony)
http://cvs.php.net/diff.php/ZendEng...=1.716.2.6&ty=u
Index: ZendEngine2/zend_execute.c
diff -u ZendEngine2/zend_execute.c:1.716.2.5 ZendEngine2/zend_execute.c:1.716.2.6
--- ZendEngine2/zend_execute.c:1.716.2.5 Mon Oct 31 14:25:03 2005
+++ ZendEngine2/zend_execute.c Wed Nov 16 06:52:26 2005
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: zend_execute.c,v 1.716.2.5 2005/10/31 19:25:03 dmitry Exp $ */
+/* $Id: zend_execute.c,v 1.716.2.6 2005/11/16 11:52:26 dmitry Exp $ */
#define ZEND_INTENSIVE_DEBUGGING 0
@@ -1250,11 +1250,6 @@
return;
}
- if ((type==BP_VAR_W || type==BP_VAR_RW) && container->refcount>1 && !PZVAL_IS_REF(container)) {
- SEPARATE_ZVAL(container_ptr);
- container = *container_ptr;
- }
-
if (Z_OBJ_HT_P(container)->get_property_ptr_ptr) {
zval **ptr_ptr = Z_OBJ_HT_P(container)->get_property_ptr_ptr(container, prop_ptr TSRMLS_CC);
if(NULL == ptr_ptr) {
http://cvs.php.net/diff.php/ZendEng...=1.135.2.4&ty=u
Index: ZendEngine2/zend_object_handlers.c
diff -u ZendEngine2/zend_object_handlers.c:1.135.2.3 ZendEngine2/zend_object_handlers.c:1.135.2.4
--- ZendEngine2/zend_object_handlers.c:1.135.2.3 Tue Nov 15 08:35:22 2005
+++ ZendEngine2/zend_object_handlers.c Wed Nov 16 06:52:27 2005
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: zend_object_handlers.c,v 1.135.2.3 2005/11/15 13:35:22 dmitry Exp $ */
+/* $Id: zend_object_handlers.c,v 1.135.2.4 2005/11/16 11:52:27 dmitry Exp $ */
#include "zend.h"
#include "zend_globals.h"
@@ -381,13 +381,15 @@
/* if we are assigning reference, we shouldn't move it, but instead assign variable
to the same pointer */
if (PZVAL_IS_REF(*variable_ptr)) {
- zval_dtor(*variable_ptr); /* old value should be destroyed */
+ zval garbage = **variable_ptr; /* old value should be destroyed */
+
/* To check: can't *variable_ptr be some system variable like error_zval here? */
(*variable_ptr)->type = value->type;
(*variable_ptr)->value = value->value;
if (value->refcount>0) {
zval_copy_ctor(*variable_ptr);
}
+ zval_dtor(&garbage);
setter_done = 1;
}
}
http://cvs.php.net/co.php/ZendEngin....phpt?r=1.1&p=1
Index: ZendEngine2/tests/bug35239.phpt
+++ ZendEngine2/tests/bug35239.phpt
|