Fixed bug #54367 (Use of closure causes problem in ArrayAccess)

Zend/zend_execute_API.c

@@ -433,26 +433,28 @@ ZEND_API zend_bool zend_is_executing(TSRMLS_D) /* {{{ */
 
 ZEND_API void _zval_ptr_dtor(zval **zval_ptr ZEND_FILE_LINE_DC) /* {{{ */
 {
+	zval *zv = *zval_ptr;
+
 #if DEBUG_ZEND>=2
 	printf("Reducing refcount for %x (%x): %d->%d\n", *zval_ptr, zval_ptr, Z_REFCOUNT_PP(zval_ptr), Z_REFCOUNT_PP(zval_ptr) - 1);
 #endif
-	Z_DELREF_PP(zval_ptr);
-	if (Z_REFCOUNT_PP(zval_ptr) == 0) {
+	Z_DELREF_P(zv);
+	if (Z_REFCOUNT_P(zv) == 0) {
 		TSRMLS_FETCH();
 
-		if (*zval_ptr != &EG(uninitialized_zval)) {
-			GC_REMOVE_ZVAL_FROM_BUFFER(*zval_ptr);
-			zval_dtor(*zval_ptr);
-			efree_rel(*zval_ptr);
+		if (zv != &EG(uninitialized_zval)) {
+			GC_REMOVE_ZVAL_FROM_BUFFER(zv);
+			zval_dtor(zv);
+			efree_rel(zv);
 		}
 	} else {
 		TSRMLS_FETCH();
 
-		if (Z_REFCOUNT_PP(zval_ptr) == 1) {
-			Z_UNSET_ISREF_PP(zval_ptr);
+		if (Z_REFCOUNT_P(zv) == 1) {
+			Z_UNSET_ISREF_P(zv);
 		}
 
-		GC_ZVAL_CHECK_POSSIBLE_ROOT(*zval_ptr);
+		GC_ZVAL_CHECK_POSSIBLE_ROOT(zv);
 	}
 }
 /* }}} */