- Bugfix #29493 (extract(array, EXTR_REFS) misbehaves with elements referred

twice or more times). (Patch inspired by Michael Manley. Thanks.)

ext/standard/array.c

@@ -1377,13 +1377,16 @@ PHP_FUNCTION(extract)
 				if (extract_refs) {
 					zval **orig_var;
 
-					SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
-					zval_add_ref(entry);
-
 					if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS) {
 						zval_ptr_dtor(orig_var);
+
+						SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
+						zval_add_ref(entry);
+						
 						*orig_var = *entry;
 					} else {
+						(*entry)->is_ref = 1;
+						zval_add_ref(entry);
 						zend_hash_update(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) entry, sizeof(zval *), NULL);
 					}
 				} else {