php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #69376 Wrong ref counting
Submitted: 2015-04-04 15:36 UTC Modified: 2015-04-05 06:00 UTC
From: nicolas dot grekas+php at gmail dot com Assigned: dmitry (profile)
Status: Closed Package: Scripting Engine problem
PHP Version: master-Git-2015-04-04 (snap) OS:
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: nicolas dot grekas+php at gmail dot com
New email:
PHP Version: OS:

 

 [2015-04-04 15:36 UTC] nicolas dot grekas+php at gmail dot com
Description:
------------
The test() function below triggers a bug in the ref counting of PHP7.
The issue was fixed in 5.6 and early 7.0, but the most recent 7.0 break this again.

See this in action at http://3v4l.org/0g0ID


Test script:
---------------
<?php

function &test() {
    $var = array();
    $var[] =& $var;

    return $var;
};

$a = test();
$b = $a;
$b[0] = 123;

print_r($a);
print_r($b);

Expected result:
----------------
Array
(
    [0] => 123
)
Array
(
    [0] => 123
)

Actual result:
--------------
Array
(
    [0] => Array
 *RECURSION*
)
Array
(
    [0] => 123
)

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-04-05 06:00 UTC] laruence@php.net
-Status: Open +Status: Analyzed
 [2015-04-05 06:00 UTC] laruence@php.net
we should deref if the refcount's refcount reach 1..

anyway, there are lot's of place need to check this...

similar:

$array = array();
$array[] = &$array;

$a = $array;
unset($array);

$b = $a;
$b[0] = 123;

print_r($a);
print_r($b);

thanks
 [2015-04-05 06:00 UTC] laruence@php.net
-Assigned To: +Assigned To: dmitry
 [2015-04-05 06:00 UTC] laruence@php.net
-Status: Analyzed +Status: Assigned
 [2015-04-06 23:36 UTC] dmitry@php.net
Automatic comment on behalf of dmitry@zend.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=55cdde3dd6c986e9e80d2f944ddfaab55c32a93a
Log: Fixed bug #69376 (Wrong ref counting).
 [2015-04-06 23:36 UTC] dmitry@php.net
-Status: Assigned +Status: Closed
 [2016-07-20 11:39 UTC] davey@php.net
Automatic comment on behalf of dmitry@zend.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=55cdde3dd6c986e9e80d2f944ddfaab55c32a93a
Log: Fixed bug #69376 (Wrong ref counting).
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Tue Jul 01 22:01:36 2025 UTC