Bug #52861: unset fails with ArrayObject and deep arrays

Mike Willbanks · smalyshev · commit 61099f858571 · 2013-02-26T22:11:52.000-08:00
When checking to make into a reference write, readwrite are checked but not unset
diff --git a/NEWS b/NEWS
@@ -6,6 +6,8 @@ PHP                                                                        NEWS
   . Fixed bug #64264 (SPLFixedArray toArray problem). (Laruence)
   . Fixed bug #64228 (RecursiveDirectoryIterator always assumes SKIP_DOTS).
     (patch by kriss@krizalys.com, Laruence)
+  . Fixed bug #52861 (unset fails with ArrayObject and deep arrays). 
+    (Mike Willbanks)
 
 21 Feb 2013, PHP 5.3.22
 
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
@@ -408,7 +408,7 @@ static zval *spl_array_read_dimension_ex(int check_inherited, zval *object, zval
 	/* When in a write context,
 	 * ZE has to be fooled into thinking this is in a reference set
 	 * by separating (if necessary) and returning as an is_ref=1 zval (even if refcount == 1) */
-	if ((type == BP_VAR_W || type == BP_VAR_RW) && !Z_ISREF_PP(ret)) {
+	if ((type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET) && !Z_ISREF_PP(ret)) {
 		if (Z_REFCOUNT_PP(ret) > 1) {
 			zval *newval;
 
diff --git a/ext/spl/tests/bug52861.phpt b/ext/spl/tests/bug52861.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #52861 (unset failes with ArrayObject and deep arrays)
+--FILE--
+<?php
+$arrayObject = new ArrayObject(array('foo' => array('bar' => array('baz' => 'boo'))));
+
+unset($arrayObject['foo']['bar']['baz']);
+print_r($arrayObject->getArrayCopy());
+?>
+--EXPECT--
+Array
+(
+    [foo] => Array
+        (
+            [bar] => Array
+                (
+                )
+
+        )
+
+)
+
