php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #31213 Fix for #29493 seem to have caused other errors
Submitted: 2004-12-21 00:11 UTC Modified: 2005-06-21 14:27 UTC
Votes:4
Avg. Score:3.8 ± 1.3
Reproduced:4 of 4 (100.0%)
Same Version:0 (0.0%)
Same OS:4 (100.0%)
From: mikael at SPAMMENOTchl dot chalmers dot se Assigned: dmitry (profile)
Status: Closed Package: Scripting Engine problem
PHP Version: 4CVS-2005-06-08 (only!) OS: *
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: mikael at SPAMMENOTchl dot chalmers dot se
New email:
PHP Version: OS:

 

 [2004-12-21 00:11 UTC] mikael at SPAMMENOTchl dot chalmers dot se
Description:
------------
In regard to bug #29493 (would have added a comment to it if I could)

--

This fix seems to have been backported to PHP 4.3.9, now we get other errors. 

In the example below $acopy is a reference to $arr['acopy'] and $a is also a reference to $arr['acopy'], when actually $a should have been separated from $arr['acopy'] when extract() makes the $acopy reference to $arr['acopy'] since   the array is created with 'acopy' => $a

$b, $arr['bref'] and $bref should and does however all point to the same value as they should since the array is created with 'bref' => &$b

Reproduce code:
------------


Reproduce code:
---------------
$a = 1; $b = 1;
$arr = array('acopy' => $a, 'bref' => &$b);

extract($arr, EXTR_REFS);

$acopy++;
$bref++;

debug_zval_dump($a, $b, $arr, $acopy, $bref);

Expected result:
----------------
(As seen on PHP < 4.3.9):

$a: long(1) refcount(2)
$b: long(2) refcount(1)
$arr: array(2) refcount(2){
  ["acopy"]=>
  &long(2) refcount(2)
  ["bref"]=>
  &long(2) refcount(3)
}
$acopy: long(2) refcount(1)
$bref: long(2) refcount(1)

Note: Shouldn't the refcount of $a be == 1 instead of 2. $a should be a separate zval while $arr['acopy'] and $acopy should be references to the same value as indicated by the refcount of 2

Actual result:
--------------
$a is now == 2, when it should be == 1. Only $arr['acopy'] should be == 2

$a: long(2) refcount(1)
$b: long(2) refcount(1)
$arr: array(2) refcount(2){
  ["acopy"]=>
  &long(2) refcount(3)
  ["bref"]=>
  &long(2) refcount(3)
}
$acopy: long(2) refcount(1)
$bref: long(2) refcount(1)


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-01-19 22:11 UTC] sniper@php.net
See also bug #31217 and bug #30074

 [2005-06-14 09:31 UTC] derick@php.net
I discussed this briefly with Dmitry - it's not an easy fix and touching it creates other problems. We decided to suspend it until we've more time to look at it.
 [2005-06-18 04:10 UTC] sniper@php.net
That test seems to fail in HEAD now too..

 [2005-06-21 14:27 UTC] dmitry@php.net
Fixed in CVS HEAD, PHP_5_0 and PHP_4_4.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Dec 26 13:01:30 2024 UTC