Fixed bug #78436

Author: nikic

NEWS

@@ -10,6 +10,10 @@ PHP                                                                        NEWS
   . Fixed bug #78441 (Parse error due to heredoc identifier followed by digit).
     (cmb)
 
+- SPL:
+  . Fixed bug #78436 (Missing addref in SplPriorityQueue EXTR_BOTH mode).
+    (Nikita)
+
 22 Aug 2019, PHP 7.4.0beta4
 
 - Core:

ext/spl/spl_heap.c

@@ -144,7 +144,9 @@ static void spl_pqueue_extract_helper(zval *result, zval *value, int flags) /* {
 	spl_pqueue_elem *elem = Z_PTR_P(value);
 	if ((flags & SPL_PQUEUE_EXTR_BOTH) == SPL_PQUEUE_EXTR_BOTH) {
 		array_init(result);
+		Z_TRY_ADDREF(elem->data);
 		add_assoc_zval_ex(result, "data", sizeof("data") - 1, &elem->data);
+		Z_TRY_ADDREF(elem->priority);
 		add_assoc_zval_ex(result, "priority", sizeof("priority") - 1, &elem->priority);
 		return;
 	}

ext/spl/tests/bug78436.phpt

@@ -0,0 +1,46 @@
+--TEST--
+Bug #78436: Missing addref in SplPriorityQueue EXTR_BOTH mode
+--FILE--
+<?php
+
+$pq = new SplPriorityQueue();
+$pq->insert(new stdClass, 1);
+var_dump($pq);
+var_dump($pq);
+
+?>
+--EXPECT--
+object(SplPriorityQueue)#1 (3) {
+  ["flags":"SplPriorityQueue":private]=>
+  int(1)
+  ["isCorrupted":"SplPriorityQueue":private]=>
+  bool(false)
+  ["heap":"SplPriorityQueue":private]=>
+  array(1) {
+    [0]=>
+    array(2) {
+      ["data"]=>
+      object(stdClass)#2 (0) {
+      }
+      ["priority"]=>
+      int(1)
+    }
+  }
+}
+object(SplPriorityQueue)#1 (3) {
+  ["flags":"SplPriorityQueue":private]=>
+  int(1)
+  ["isCorrupted":"SplPriorityQueue":private]=>
+  bool(false)
+  ["heap":"SplPriorityQueue":private]=>
+  array(1) {
+    [0]=>
+    array(2) {
+      ["data"]=>
+      object(stdClass)#2 (0) {
+      }
+      ["priority"]=>
+      int(1)
+    }
+  }
+}