- MFH Fix refcounting

Zend/tests/closure_035.phpt

@@ -0,0 +1,44 @@
+--TEST--
+Closure 035: Rebinding closure $this on property access
+--FILE--
+<?php
+
+$instance = 0;
+
+class Test {
+	function __construct() {
+		global $instance;
+		$this->instance = ++$instance;
+	}
+}
+
+$o = new Test;
+$o->func = function () {
+	var_dump($this);
+};
+$func = $o->func;
+$func();
+
+var_dump($instance);
+?>
+===DONE===
+--EXPECTF--
+object(Test)#%d (2) {
+  ["instance"]=>
+  int(1)
+  ["func"]=>
+  object(Closure)#%d (1) {
+    ["this"]=>
+    object(Test)#%d (2) {
+      ["instance"]=>
+      int(1)
+      ["func"]=>
+      object(Closure)#2 (1) {
+        ["this"]=>
+        *RECURSION*
+      }
+    }
+  }
+}
+int(1)
+===DONE===

Zend/zend_closures.c

@@ -124,7 +124,13 @@ ZEND_API zval* zend_closure_copy(zval *closure_obj, zval *this_ptr TSRMLS_DC) /*
 
 	zval_copy_ctor(closure_obj);
 	closure = (zend_closure *)zend_object_store_get_object(closure_obj TSRMLS_CC);
+	if (closure->this_ptr) {
+		zval_ptr_dtor(&closure->this_ptr);
+	}
 	closure->this_ptr = this_ptr;
+	if (this_ptr) {
+		Z_ADDREF_P(this_ptr);
+	}
 	return closure_obj;
 }
 /* }}} */