Fixed bug #72369 (array_merge() produces references in PHP7)

This commit is contained in:
Dmitry Stogov 2016-06-09 15:07:44 +03:00
parent 65b6950a56
commit bfcf32237e
3 changed files with 27 additions and 5 deletions

1
NEWS
View File

@ -38,6 +38,7 @@ PHP NEWS
. Fixed bug #72197 (pg_lo_create arbitrary read). (Anatol)
- Standard:
. Fixed bug #72369 (array_merge() produces references in PHP7). (Dmitry)
. Fixed bug #72300 (ignore_user_abort(false) has no effect). (Laruence)
. Fixed bug #72229 (Wrong reference when serialize/unserialize an object).
(Laruence)

View File

@ -3095,15 +3095,20 @@ PHPAPI int php_array_merge(HashTable *dest, HashTable *src) /* {{{ */
zend_string *string_key;
ZEND_HASH_FOREACH_STR_KEY_VAL(src, string_key, src_entry) {
if (string_key) {
if (Z_REFCOUNTED_P(src_entry)) {
if (Z_REFCOUNTED_P(src_entry)) {
if (UNEXPECTED(Z_ISREF_P(src_entry))
&& UNEXPECTED(Z_REFCOUNT_P(src_entry) == 1)) {
ZVAL_UNREF(src_entry);
if (Z_REFCOUNTED_P(src_entry)) {
Z_ADDREF_P(src_entry);
}
} else {
Z_ADDREF_P(src_entry);
}
}
if (string_key) {
zend_hash_update(dest, string_key, src_entry);
} else {
if (Z_REFCOUNTED_P(src_entry)) {
Z_ADDREF_P(src_entry);
}
zend_hash_next_index_insert_new(dest, src_entry);
}
} ZEND_HASH_FOREACH_END();

View File

@ -0,0 +1,16 @@
--TEST--
Bug #72369 (array_merge() produces references in PHP7)
--FILE--
<?php
$x = 'xxx';
$d = ['test' => &$x];
unset($x);
$a = ['test' => 'yyy'];
$a = array_merge($a, $d);
debug_zval_dump($a);
?>
--EXPECTF--
array(1) refcount(%d){
["test"]=>
string(3) "xxx" refcount(%d)
}