Attached is a patch for bug #21600.

This problem is caused by unnecessary zval destruction performed when
trying to assign a value that is originated from the same zval.

Moriyoshi
Index: Zend/zend_execute.c
===================================================================
RCS file: /repository/Zend/zend_execute.c,v
retrieving revision 1.316.2.3
diff -u -r1.316.2.3 zend_execute.c
--- Zend/zend_execute.c 31 Dec 2002 16:22:59 -0000      1.316.2.3
+++ Zend/zend_execute.c 13 Jan 2003 00:34:32 -0000
@@ -265,27 +265,37 @@
                variable_ptr_ptr = &EG(uninitialized_zval_ptr);
 /*     } else if (variable_ptr==&EG(uninitialized_zval) || variable_ptr!=value_ptr) { 
*/
        } else if (variable_ptr_ptr != value_ptr_ptr) {
-               variable_ptr->refcount--;
-               if (variable_ptr->refcount==0) {
-                       zendi_zval_dtor(*variable_ptr);
-                       FREE_ZVAL(variable_ptr);
-               }
+               if (variable_ptr != value_ptr) {
+                       variable_ptr->refcount--;
+                       if (variable_ptr->refcount==0) {
+                               zendi_zval_dtor(*variable_ptr);
+                               FREE_ZVAL(variable_ptr);
+                       }
 
-               if (!PZVAL_IS_REF(value_ptr)) {
-                       /* break it away */
-                       value_ptr->refcount--;
-                       if (value_ptr->refcount>0) {
-                               ALLOC_ZVAL(*value_ptr_ptr);
-                               **value_ptr_ptr = *value_ptr;
-                               value_ptr = *value_ptr_ptr;
-                               zendi_zval_copy_ctor(*value_ptr);
+                       if (!PZVAL_IS_REF(value_ptr)) {
+                               /* break it away */
+                               value_ptr->refcount--;
+                               if (value_ptr->refcount>0) {
+                                       ALLOC_ZVAL(*value_ptr_ptr);
+                                       **value_ptr_ptr = *value_ptr;
+                                       value_ptr = *value_ptr_ptr;
+                                       zendi_zval_copy_ctor(*value_ptr);
+                               }
+                               value_ptr->refcount = 1;
+                               value_ptr->is_ref = 1;
+                       }
+                       *variable_ptr_ptr = value_ptr;
+                       value_ptr->refcount++;
+               } else {
+                       if (value_ptr == EG(uninitialized_zval_ptr)) {
+                               ALLOC_ZVAL(value_ptr);
+                               value_ptr->type = IS_NULL;
+                               value_ptr->refcount = 1;
+                               value_ptr->is_ref = 1;
+                               *variable_ptr_ptr = *value_ptr_ptr = value_ptr;
+                               value_ptr->refcount++;
                        }
-                       value_ptr->refcount = 1;
-                       value_ptr->is_ref = 1;
                }
-
-               *variable_ptr_ptr = value_ptr;
-               value_ptr->refcount++;
        } else {
                if (variable_ptr->refcount>1) { /* we need to break away */
                        SEPARATE_ZVAL(variable_ptr_ptr);

-- 
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, visit: http://www.php.net/unsub.php

Reply via email to