laruence Thu, 03 Nov 2011 03:59:41 +0000
Revision: http://svn.php.net/viewvc?view=revision&revision=318716
Log:
Fix bug #60169 Conjunction of ternary and list crashes PHP
Bug: https://bugs.php.net/60169 (Assigned) Conjunction of ternary and list
crashes PHP
Changed paths:
U php/php-src/branches/PHP_5_4/NEWS
U php/php-src/branches/PHP_5_4/Zend/tests/bug60169.phpt
U php/php-src/branches/PHP_5_4/Zend/zend_vm_def.h
U php/php-src/branches/PHP_5_4/Zend/zend_vm_execute.h
U php/php-src/trunk/Zend/tests/bug60169.phpt
U php/php-src/trunk/Zend/zend_vm_def.h
U php/php-src/trunk/Zend/zend_vm_execute.h
Modified: php/php-src/branches/PHP_5_4/NEWS
===================================================================
--- php/php-src/branches/PHP_5_4/NEWS 2011-11-03 02:52:28 UTC (rev 318715)
+++ php/php-src/branches/PHP_5_4/NEWS 2011-11-03 03:59:41 UTC (rev 318716)
@@ -17,6 +17,8 @@
the data exceeds or is equal to 2048 bytes). (Pierre, Pascal Borreli)
. Fixed bug #60174 (Notice when array in method prototype error).
(Laruence)
+ . Fixed bug #60169 (Conjunction of ternary and list crashes PHP).
+ (Laruence)
- Oracle Database extension (OCI8):
. Increased maxium Oracle error message buffer length for new 11.2.0.3 size
Modified: php/php-src/branches/PHP_5_4/Zend/tests/bug60169.phpt
===================================================================
--- php/php-src/branches/PHP_5_4/Zend/tests/bug60169.phpt 2011-11-03 02:52:28 UTC (rev 318715)
+++ php/php-src/branches/PHP_5_4/Zend/tests/bug60169.phpt 2011-11-03 03:59:41 UTC (rev 318716)
@@ -1,7 +1,5 @@
--TEST--
Bug #60169 (Conjunction of ternary and list crashes PHP)
---XFAIL--
-See Bug #60169, doesn't fixed yet
--FILE--
<?php
error_reporting(0);
Modified: php/php-src/branches/PHP_5_4/Zend/zend_vm_def.h
===================================================================
--- php/php-src/branches/PHP_5_4/Zend/zend_vm_def.h 2011-11-03 02:52:28 UTC (rev 318715)
+++ php/php-src/branches/PHP_5_4/Zend/zend_vm_def.h 2011-11-03 03:59:41 UTC (rev 318716)
@@ -4689,12 +4689,12 @@
if (OP1_TYPE == IS_VAR || OP1_TYPE == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!IS_OP1_TMP_FREE()) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
@@ -4741,12 +4741,12 @@
if (OP1_TYPE == IS_VAR || OP1_TYPE == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!IS_OP1_TMP_FREE()) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
Modified: php/php-src/branches/PHP_5_4/Zend/zend_vm_execute.h
===================================================================
--- php/php-src/branches/PHP_5_4/Zend/zend_vm_execute.h 2011-11-03 02:52:28 UTC (rev 318715)
+++ php/php-src/branches/PHP_5_4/Zend/zend_vm_execute.h 2011-11-03 03:59:41 UTC (rev 318716)
@@ -2863,12 +2863,12 @@
if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!0) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
@@ -2914,12 +2914,12 @@
if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!0) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
@@ -7223,12 +7223,12 @@
if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!1) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
@@ -7275,12 +7275,12 @@
if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!1) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
@@ -11694,12 +11694,12 @@
if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!0) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
@@ -11746,12 +11746,12 @@
if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!0) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
@@ -27346,12 +27346,12 @@
if (IS_CV == IS_VAR || IS_CV == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!0) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
@@ -27397,12 +27397,12 @@
if (IS_CV == IS_VAR || IS_CV == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!0) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
Modified: php/php-src/trunk/Zend/tests/bug60169.phpt
===================================================================
--- php/php-src/trunk/Zend/tests/bug60169.phpt 2011-11-03 02:52:28 UTC (rev 318715)
+++ php/php-src/trunk/Zend/tests/bug60169.phpt 2011-11-03 03:59:41 UTC (rev 318716)
@@ -1,7 +1,5 @@
--TEST--
Bug #60169 (Conjunction of ternary and list crashes PHP)
---XFAIL--
-See Bug #60169, doesn't fixed yet
--FILE--
<?php
error_reporting(0);
Modified: php/php-src/trunk/Zend/zend_vm_def.h
===================================================================
--- php/php-src/trunk/Zend/zend_vm_def.h 2011-11-03 02:52:28 UTC (rev 318715)
+++ php/php-src/trunk/Zend/zend_vm_def.h 2011-11-03 03:59:41 UTC (rev 318716)
@@ -4689,12 +4689,12 @@
if (OP1_TYPE == IS_VAR || OP1_TYPE == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!IS_OP1_TMP_FREE()) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
@@ -4741,12 +4741,12 @@
if (OP1_TYPE == IS_VAR || OP1_TYPE == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!IS_OP1_TMP_FREE()) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
Modified: php/php-src/trunk/Zend/zend_vm_execute.h
===================================================================
--- php/php-src/trunk/Zend/zend_vm_execute.h 2011-11-03 02:52:28 UTC (rev 318715)
+++ php/php-src/trunk/Zend/zend_vm_execute.h 2011-11-03 03:59:41 UTC (rev 318716)
@@ -2863,12 +2863,12 @@
if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!0) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
@@ -2914,12 +2914,12 @@
if (IS_CONST == IS_VAR || IS_CONST == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!0) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
@@ -7223,12 +7223,12 @@
if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!1) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
@@ -7275,12 +7275,12 @@
if (IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!1) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
@@ -11694,12 +11694,12 @@
if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!0) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
@@ -11746,12 +11746,12 @@
if (IS_VAR == IS_VAR || IS_VAR == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!0) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
@@ -27346,12 +27346,12 @@
if (IS_CV == IS_VAR || IS_CV == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!0) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
@@ -27397,12 +27397,12 @@
if (IS_CV == IS_VAR || IS_CV == IS_CV) {
Z_ADDREF_P(value);
EX_T(opline->result.var).var.ptr = value;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
} else {
ALLOC_ZVAL(ret);
INIT_PZVAL_COPY(ret, value);
EX_T(opline->result.var).var.ptr = ret;
- EX_T(opline->result.var).var.ptr_ptr = NULL;
+ EX_T(opline->result.var).var.ptr_ptr = &EX_T(opline->result.var).var.ptr;
if (!0) {
zval_copy_ctor(EX_T(opline->result.var).var.ptr);
}
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
