- Allow is_ref to become 0 in case the refcount is back to 1.

Zend/zend_execute_API.c

@@ -217,9 +217,11 @@ ZEND_API void _zval_ptr_dtor(zval **zval_ptr ZEND_FILE_LINE_DC)
 	if ((*zval_ptr)->refcount==0) {
 		zval_dtor(*zval_ptr);
 		safe_free_zval_ptr(*zval_ptr);
+	} else if ((*zval_ptr)->refcount == 1) {
+		(*zval_ptr)->is_ref = 0;
 	}
 }
-
+	
 
 ZEND_API inline int i_zend_is_true(zval *op)
 {

Zend/zend_opcode.c

@@ -313,9 +313,11 @@ void pass_include_eval(zend_op_array *op_array)
 	while (opline<end) {
 		if (opline->op1.op_type==IS_CONST) {
 			opline->op1.u.constant.is_ref = 1;
+			opline->op1.u.constant.refcount = 2; /* Make sure is_ref won't be reset */
 		}
 		if (opline->op2.op_type==IS_CONST) {
 			opline->op2.u.constant.is_ref = 1;
+			opline->op2.u.constant.refcount = 2;
 		}
 		opline++;
 	}