diff --git a/ext/standard/array.c b/ext/standard/array.c index a84fa50d61f0e..cabafaaa67edf 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -3571,7 +3571,8 @@ PHP_FUNCTION(array_pop) break; } } - RETVAL_COPY_DEREF(val); + RETVAL_COPY_VALUE(val); + ZVAL_UNDEF(val); if (idx == (Z_ARRVAL_P(stack)->nNextFreeElement - 1)) { Z_ARRVAL_P(stack)->nNextFreeElement = Z_ARRVAL_P(stack)->nNextFreeElement - 1; @@ -3595,7 +3596,8 @@ PHP_FUNCTION(array_pop) break; } } - RETVAL_COPY_DEREF(val); + RETVAL_COPY_VALUE(val); + ZVAL_UNDEF(val); if (!p->key && (zend_long)p->h == (Z_ARRVAL_P(stack)->nNextFreeElement - 1)) { Z_ARRVAL_P(stack)->nNextFreeElement = Z_ARRVAL_P(stack)->nNextFreeElement - 1; @@ -3605,6 +3607,10 @@ PHP_FUNCTION(array_pop) zend_hash_del_bucket(Z_ARRVAL_P(stack), p); } zend_hash_internal_pointer_reset(Z_ARRVAL_P(stack)); + + if (Z_ISREF_P(return_value)) { + zend_unwrap_reference(return_value); + } } /* }}} */ diff --git a/ext/standard/tests/array/gh17447.phpt b/ext/standard/tests/array/gh17447.phpt new file mode 100644 index 0000000000000..e107efbd17bfa --- /dev/null +++ b/ext/standard/tests/array/gh17447.phpt @@ -0,0 +1,12 @@ +--TEST-- +GH-17447 (Assertion failure when array poping a self addressing variable) +--FILE-- + +--EXPECT-- +array(0) { +} +array(0) { +}