Description:
------------
If a function (or object method) returns a reference (as a return value or by writing to a reference supplied as a parameter), and the caller saves that reference in a variable, the object/array/variable that is referenced is incorrectly cloned.

Interestingly, if the return value is passed directly to 2nd function (or object method) the bug does not occur, that is, the variable is not cloned and the reference is passed to 2nd function in-tact.


Reproduce code:
---------------
I have provided two scripts to reproduce the bug. One is a procedural example (reftest-array2.php) and the other is an OO example (reftest-object2.php).

They can be downloaded from http://www.tellusion.com/reftest2.tar

ISOLATION

This is potentially related but still separate to bug #39944 (which was fixed). I have modified two of the scripts I submitted previosuly to clearly demonstrate the presence of this bug only.

The bug is present in PHP 5.0.4 and all versions of PHP 5.1 & 5.2 including the latest version of 5.2-STABLE.

I haven?t tested any older versions of PHP.

Expected result:
----------------
### reftest-array2.php ###

arrTheArray = Array
(
    [0] => xx1
    [1] => xx2
    [2] => xx3
)

### reftest-object2.php ###

RefTest::addToArray(): arr = Array
(
    [0] => xx1
)

RefTest::addToArray(): arr = Array
(
    [0] => xx1
    [1] => xx2
)

RefTest::addToArray(): arr = Array
(
    [0] => xx1
    [1] => xx2
    [2] => xx3
)

objRefTest->getArray() = Array
(
    [0] => xx1
    [1] => xx2
    [2] => xx3
)

Actual result:
--------------
### reftest-array2.php ###

arrTheArray = Array
(
    [0] => xx3
)

### reftest-object2.php ###

RefTest::addToArray(): arr = Array
(
    [0] => xx1
)

RefTest::addToArray(): arr = Array
(
    [0] => xx2
)

RefTest::addToArray(): arr = Array
(
    [0] => xx3
)

objRefTest->getArray() = Array
(
)