From 04379bcb1df25a9f9cc1d440f5c12105b9fbaf97 Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@gmail.com>
Date: Fri, 13 Jan 2017 13:04:37 +0800
Subject: [PATCH 1/2] Fixed bug #73916 (zend_print_flat_zval_r doesn't consider
 reference)

---
 NEWS                     |  4 +++-
 Zend/tests/bug73916.phpt | 16 ++++++++++++++++
 Zend/zend.c              |  3 +++
 3 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 Zend/tests/bug73916.phpt

diff --git a/NEWS b/NEWS
index efbee5e7175..27788427d41 100644
--- a/NEWS
+++ b/NEWS
@@ -3,8 +3,10 @@ PHP                                                                        NEWS
 ?? ??? 2017 PHP 7.0.16
 
 - Core:
+  . Fixed bug #73916 (zend_print_flat_zval_r doesn't consider reference).
+    (Laruence)
   . Fixed bug #73876 (Crash when exporting **= in expansion of assign op).
-  (Sara)
+    (Sara)
 
 - FPM:
   . Fixed bug #67583 (double fastcgi_end_request on max_children limit).
diff --git a/Zend/tests/bug73916.phpt b/Zend/tests/bug73916.phpt
new file mode 100644
index 00000000000..ba2567ed0c4
--- /dev/null
+++ b/Zend/tests/bug73916.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #73916 (zend_print_flat_zval_r doesn't consider reference)
+--FILE--
+<?php
+$a = array('a');
+class b{};
+$b = new b;
+$test[] =& $a;
+$test[] =& $b;
+test($test);
+function test() {
+	debug_print_backtrace();
+}
+?>
+--EXPECTF--
+#0  test(Array ([0] => Array ([0] => a),[1] => b Object ())) called at [%sbug73916.php:%d]
diff --git a/Zend/zend.c b/Zend/zend.c
index 3f3ca75e382..2a47e9244ba 100644
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -312,6 +312,9 @@ ZEND_API void zend_print_flat_zval_r(zval *expr) /* {{{ */
 			ZEND_PUTS(")");
 			break;
 		}
+		case IS_REFERENCE:
+			zend_print_flat_zval_r(Z_REFVAL_P(expr));
+			break;
 		default:
 			zend_print_variable(expr);
 			break;

From b25be216c1dc2f27e54b59eb19582d4a951b4c7c Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@gmail.com>
Date: Fri, 13 Jan 2017 13:05:22 +0800
Subject: [PATCH 2/2] Remove redundant reference handling

---
 Zend/zend.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/Zend/zend.c b/Zend/zend.c
index 4430733d580..7f37e285004 100644
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -312,7 +312,6 @@ ZEND_API void zend_print_flat_zval_r(zval *expr) /* {{{ */
 
 static void zend_print_zval_r_to_buf(smart_str *buf, zval *expr, int indent) /* {{{ */
 {
-	ZVAL_DEREF(expr);
 	switch (Z_TYPE_P(expr)) {
 		case IS_ARRAY:
 			smart_str_appends(buf, "Array\n");