Fixed bug #63305 (zend_mm_heap corrupted with traits)

NEWS

@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2012, PHP 5.4.9
 
+- Core:
+  . Fixed bug #63305 (zend_mm_heap corrupted with traits). (Dmitry, Laruence)
+
 - Fileinfo:
   . Fixed bug #63248 (Load multiple magic files from a directory under Windows).
     (Anatoliy)

Zend/tests/bug63305.phpt

@@ -0,0 +1,43 @@
+--TEST--
+Bug #63305 (zend_mm_heap corrupted with traits)
+--FILE--
+<?php
+new Attachment("");
+
+function __autoload($class) {
+    switch ($class) {
+    case "Attachment":
+        eval(<<<'PHP'
+class Attachment extends File {
+}
+PHP
+    );
+        break;
+    case "File":
+        eval(<<<'PHP'
+class File {
+    use TDatabaseObject {
+        TDatabaseObject::__construct as private databaseObjectConstruct;
+    }
+    public function __construct() {
+    }
+}
+PHP
+    );
+        break;
+    case "TDatabaseObject":
+        eval(<<<'PHP'
+trait TDatabaseObject {
+    public function __construct() {
+    }
+}
+PHP
+    );
+        break;
+    }
+    return TRUE;
+}
+echo "okey";
+?>
+--EXPECT--
+okey

Zend/zend_compile.c

@@ -3885,7 +3885,7 @@ static int zend_traits_copy_functions(zend_function *fn TSRMLS_DC, int num_args,
 					
 				/* if it is 0, no modifieres has been changed */
 				if (aliases[i]->modifiers) { 
-					fn_copy.common.fn_flags = aliases[i]->modifiers;
+					fn_copy.common.fn_flags = aliases[i]->modifiers | ZEND_ACC_ALIAS;
 					if (!(aliases[i]->modifiers & ZEND_ACC_PPP_MASK)) {
 						fn_copy.common.fn_flags |= ZEND_ACC_PUBLIC;
 					}
@@ -3926,7 +3926,7 @@ static int zend_traits_copy_functions(zend_function *fn TSRMLS_DC, int num_args,
 					&& (!aliases[i]->trait_method->ce || fn->common.scope == aliases[i]->trait_method->ce)
 					&& (aliases[i]->trait_method->mname_len == fnname_len)
 					&& (zend_binary_strcasecmp(aliases[i]->trait_method->method_name, aliases[i]->trait_method->mname_len, fn->common.function_name, fnname_len) == 0)) {
-					fn_copy.common.fn_flags = aliases[i]->modifiers;
+					fn_copy.common.fn_flags = aliases[i]->modifiers | ZEND_ACC_ALIAS;
 
 					if (!(aliases[i]->modifiers & ZEND_ACC_PPP_MASK)) {
 						fn_copy.common.fn_flags |= ZEND_ACC_PUBLIC;