Merge branch 'PHP-7.4'

2 files changed, 48 insertions, 0 deletions

diff --git a/ext/spl/spl_heap.c b/ext/spl/spl_heap.c
index f33357df54..068cb328a6 100644
--- a/ext/spl/spl_heap.c
+++ b/ext/spl/spl_heap.c
@@ -144,7 +144,9 @@ static void spl_pqueue_extract_helper(zval *result, zval *value, int flags) /* {
 	spl_pqueue_elem *elem = Z_PTR_P(value);
 	if ((flags & SPL_PQUEUE_EXTR_BOTH) == SPL_PQUEUE_EXTR_BOTH) {
 		array_init(result);
+		Z_TRY_ADDREF(elem->data);
 		add_assoc_zval_ex(result, "data", sizeof("data") - 1, &elem->data);
+		Z_TRY_ADDREF(elem->priority);
 		add_assoc_zval_ex(result, "priority", sizeof("priority") - 1, &elem->priority);
 		return;
 	}
diff --git a/ext/spl/tests/bug78436.phpt b/ext/spl/tests/bug78436.phpt
new file mode 100644
index 0000000000..8b978d5a4b
--- /dev/null
+++ b/ext/spl/tests/bug78436.phpt
@@ -0,0 +1,46 @@
+--TEST--
+Bug #78436: Missing addref in SplPriorityQueue EXTR_BOTH mode
+--FILE--
+<?php
+
+$pq = new SplPriorityQueue();
+$pq->insert(new stdClass, 1);
+var_dump($pq);
+var_dump($pq);
+
+?>
+--EXPECT--
+object(SplPriorityQueue)#1 (3) {
+  ["flags":"SplPriorityQueue":private]=>
+  int(1)
+  ["isCorrupted":"SplPriorityQueue":private]=>
+  bool(false)
+  ["heap":"SplPriorityQueue":private]=>
+  array(1) {
+    [0]=>
+    array(2) {
+      ["data"]=>
+      object(stdClass)#2 (0) {
+      }
+      ["priority"]=>
+      int(1)
+    }
+  }
+}
+object(SplPriorityQueue)#1 (3) {
+  ["flags":"SplPriorityQueue":private]=>
+  int(1)
+  ["isCorrupted":"SplPriorityQueue":private]=>
+  bool(false)
+  ["heap":"SplPriorityQueue":private]=>
+  array(1) {
+    [0]=>
+    array(2) {
+      ["data"]=>
+      object(stdClass)#2 (0) {
+      }
+      ["priority"]=>
+      int(1)
+    }
+  }
+}