php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #31213 Fix for #29493 seem to have caused other errors
Submitted: 2004-12-21 00:11 UTC Modified: 2005-06-21 14:27 UTC
Votes:4
Avg. Score:3.8 ± 1.3
Reproduced:4 of 4 (100.0%)
Same Version:0 (0.0%)
Same OS:4 (100.0%)
From: mikael at SPAMMENOTchl dot chalmers dot se Assigned: dmitry
Status: Closed Package: Scripting Engine problem
PHP Version: 4CVS-2005-06-08 (only!) OS: *
Private report: No CVE-ID:
 [2004-12-21 00:11 UTC] mikael at SPAMMENOTchl dot chalmers dot se
Description:
------------
In regard to bug #29493 (would have added a comment to it if I could)

--

This fix seems to have been backported to PHP 4.3.9, now we get other errors. 

In the example below $acopy is a reference to $arr['acopy'] and $a is also a reference to $arr['acopy'], when actually $a should have been separated from $arr['acopy'] when extract() makes the $acopy reference to $arr['acopy'] since   the array is created with 'acopy' => $a

$b, $arr['bref'] and $bref should and does however all point to the same value as they should since the array is created with 'bref' => &$b

Reproduce code:
------------


Reproduce code:
---------------
$a = 1; $b = 1;
$arr = array('acopy' => $a, 'bref' => &$b);

extract($arr, EXTR_REFS);

$acopy++;
$bref++;

debug_zval_dump($a, $b, $arr, $acopy, $bref);

Expected result:
----------------
(As seen on PHP < 4.3.9):

$a: long(1) refcount(2)
$b: long(2) refcount(1)
$arr: array(2) refcount(2){
  ["acopy"]=>
  &long(2) refcount(2)
  ["bref"]=>
  &long(2) refcount(3)
}
$acopy: long(2) refcount(1)
$bref: long(2) refcount(1)

Note: Shouldn't the refcount of $a be == 1 instead of 2. $a should be a separate zval while $arr['acopy'] and $acopy should be references to the same value as indicated by the refcount of 2

Actual result:
--------------
$a is now == 2, when it should be == 1. Only $arr['acopy'] should be == 2

$a: long(2) refcount(1)
$b: long(2) refcount(1)
$arr: array(2) refcount(2){
  ["acopy"]=>
  &long(2) refcount(3)
  ["bref"]=>
  &long(2) refcount(3)
}
$acopy: long(2) refcount(1)
$bref: long(2) refcount(1)


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-01-19 22:11 UTC] sniper@php.net
See also bug #31217 and bug #30074

 [2005-06-14 09:31 UTC] derick@php.net
I discussed this briefly with Dmitry - it's not an easy fix and touching it creates other problems. We decided to suspend it until we've more time to look at it.
 [2005-06-18 04:10 UTC] sniper@php.net
That test seems to fail in HEAD now too..

 [2005-06-21 14:27 UTC] dmitry@php.net
Fixed in CVS HEAD, PHP_5_0 and PHP_4_4.
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Sat Apr 19 06:02:27 2014 UTC