diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2018-01-09 20:25:19 +0100 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2018-01-09 20:25:19 +0100 |
| commit | d9c706f28d7533f93e91cbba666f51d65b863220 (patch) | |
| tree | 3732d6ab0b65e0e34aa137474364715fc51c1447 /Zend | |
| parent | 0c25ea355fcf51b406df8a7c7f7f094d680c1532 (diff) | |
| parent | 2dd80a078251273cdfd8d8fda71651e5ecc40040 (diff) | |
| download | php-git-d9c706f28d7533f93e91cbba666f51d65b863220.tar.gz | |
Merge branch 'PHP-7.2'
Diffstat (limited to 'Zend')
| -rw-r--r-- | Zend/tests/bug75786.phpt | 18 | ||||
| -rw-r--r-- | Zend/zend_vm_def.h | 7 | ||||
| -rw-r--r-- | Zend/zend_vm_execute.h | 7 |
3 files changed, 22 insertions, 10 deletions
diff --git a/Zend/tests/bug75786.phpt b/Zend/tests/bug75786.phpt new file mode 100644 index 0000000000..b93111b9e3 --- /dev/null +++ b/Zend/tests/bug75786.phpt @@ -0,0 +1,18 @@ +--TEST-- +Bug #75786: segfault when using spread operator on generator passed by reference +--FILE-- +<?php + +function &gen($items) { + foreach ($items as $key => &$value) { + yield $key => $value; + } +} + +var_dump(...gen(['a', 'b', 'c'])); + +?> +--EXPECT-- +string(1) "a" +string(1) "b" +string(1) "c" diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index 794c88f26e..6e492a987c 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -4487,11 +4487,8 @@ ZEND_VM_C_LABEL(send_again): ); } - if (Z_ISREF_P(arg)) { - ZVAL_DUP(arg, Z_REFVAL_P(arg)); - } else { - Z_TRY_ADDREF_P(arg); - } + ZVAL_DEREF(arg); + Z_TRY_ADDREF_P(arg); zend_vm_stack_extend_call_frame(&EX(call), arg_num - 1, 1); top = ZEND_CALL_ARG(EX(call), arg_num); diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index b4dc7bb2c8..feb791433c 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -1316,11 +1316,8 @@ send_again: ); } - if (Z_ISREF_P(arg)) { - ZVAL_DUP(arg, Z_REFVAL_P(arg)); - } else { - Z_TRY_ADDREF_P(arg); - } + ZVAL_DEREF(arg); + Z_TRY_ADDREF_P(arg); zend_vm_stack_extend_call_frame(&EX(call), arg_num - 1, 1); top = ZEND_CALL_ARG(EX(call), arg_num); |