diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 2e30fc170b5..1bac5e2f963 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -346,7 +346,7 @@ static inline void zend_assign_to_variable(znode *result, znode *op1, znode *op2 variable_ptr->is_ref = 1; if (type!=IS_TMP_VAR) { zendi_zval_copy_ctor(*variable_ptr); - + value->refcount--; } } } else { diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c index c56a876f164..8c610ef3018 100644 --- a/Zend/zend_execute_API.c +++ b/Zend/zend_execute_API.c @@ -487,7 +487,7 @@ ZEND_API inline void zend_assign_to_variable_reference(znode *result, zval **var if (variable_ptr == EG(error_zval_ptr) || value_ptr==EG(error_zval_ptr)) { variable_ptr_ptr = &EG(uninitialized_zval_ptr); /* } else if (variable_ptr==&EG(uninitialized_zval) || variable_ptr!=value_ptr) { */ - } else if (*variable_ptr_ptr != *value_ptr_ptr) { + } else if (variable_ptr_ptr != value_ptr_ptr) { variable_ptr->refcount--; if (variable_ptr->refcount==0) { zendi_zval_dtor(*variable_ptr); @@ -510,7 +510,10 @@ ZEND_API inline void zend_assign_to_variable_reference(znode *result, zval **var *variable_ptr_ptr = value_ptr; value_ptr->refcount++; } else { - /* nothing to do */ + if (variable_ptr->refcount>1) { /* we need to break away */ + SEPARATE_ZVAL(variable_ptr_ptr); + } + (*variable_ptr_ptr)->is_ref = 1; } if (result && (result->op_type != IS_UNUSED)) {