diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 87a30234319..dedc2e53fdc 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -310,8 +310,18 @@ static inline void zend_assign_to_object(znode *result, znode *op1, znode *op2, SEPARATE_ZVAL_IF_NOT_REF(object_ptr); object = *object_ptr; } + /* by now, property is a string */ - /* here property is a string */ + + /* separate our value if necessary */ + if (value_op->op_type == IS_TMP_VAR) { + zval *orig_value = value; + + ALLOC_ZVAL(value); + *value = *orig_value; + value->is_ref = 0; + value->refcount = 0; + } Z_OBJ_HT_P(object)->write_property(object, property, value TSRMLS_CC); if (property == &tmp) { zval_dtor(property); diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c index 4720a8bfba8..ff5764e6b01 100644 --- a/Zend/zend_object_handlers.c +++ b/Zend/zend_object_handlers.c @@ -220,7 +220,9 @@ static void zend_std_write_property(zval *object, zval *member, zval *value TSRM /* To check: can't *variable_ptr be some system variable like error_zval here? */ (*variable_ptr)->type = value->type; (*variable_ptr)->value = value->value; - zval_copy_ctor(*variable_ptr); + if (value->refcount>0) { + zval_copy_ctor(*variable_ptr); + } setter_done = 1; } }