# Another Interesting Reference Issue

- Thread: https://externals.io/message/16300
- Original archive: https://news-web.php.net/php.internals/16300
- Started by Derick Rethans on 2005-05-27T12:20:58+00:00
- Messages: 2
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #16300 — Derick Rethans — 2005-05-27T12:20:58+00:00

URL: https://externals.io/message/16300#16300

Hello,

I encountered a strange increase of the refcount with the following 
script:

<?php
	error_reporting(E_ALL);
	$tree = array (
		1 => 'one',
		2 => 'two',
		3 => 'three'
	);

	function &find_node($key, &$node)
	{
		xdebug_debug_zval('node');
		$item =& $node[$key];
		return $item;
	}

	$node =& find_node(3, $tree);
	$node = 'drie';

The xdebug_debug_zval() function looks up the given symbol in the symbol 
table, and it prints it's refcount/is_ref value too (unlike the 
 `debug_zval_dump()` function available in PHP which actually modifies 
those values). Logically you expect the refcount of $node to be 2 (once 
through the global var $tree, and once as local variable $node. But the 
refcount actually seems to be 3.

I've been tracing things in the engine and found the following places 
where the refcount of this variable is modified (file/line nos are from 
php 5.0-dev):

Old value = 1
New value = 2
zend_send_ref_handler (execute_data=0xbfffd410, opline=0x85f5440, op_array=0x85f0b64) at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:3077
3077            zend_ptr_stack_push(&EG(argument_stack), varptr);
(gdb) bt
#0  zend_send_ref_handler (execute_data=0xbfffd410, opline=0x85f5440, op_array=0x85f0b64) 
    at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:3077
#1  0x0831de66 in execute (op_array=0x85f0b64) at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:1415


Old value = 2
New value = 3
0x0831c192 in zend_assign_to_variable_reference (result=0x0, variable_ptr_ptr=0x85f74c8, value_ptr_ptr=0x85e4b8c, Ts=0x0) at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:262
262                     value_ptr->refcount++;
(gdb) bt
#0  0x0831c192 in zend_assign_to_variable_reference (result=0x0, variable_ptr_ptr=0x85f74c8, value_ptr_ptr=0x85e4b8c, Ts=0x0)
    at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:262
#1  0x083227d7 in zend_recv_handler (execute_data=0xbfffd1a0, opline=0x85f63bc, op_array=0x85f7a18)
    at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:3109
#2  0x0831de66 in execute (op_array=0x85f7a18) at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:1415

It does not matter if it's passed by reference or not - the value is 
always 3 inside the function. What is the reason for this?

regards,
Derick

-- 
Derick Rethans
http://derickrethans.nl | http://ez.no | http://xdebug.org

---

## #16301 — Dmitry Stogov — 2005-05-27T13:06:53+00:00

URL: https://externals.io/message/16300#16301 · In reply to: #16300

Hi Derick,

One for global $tree.

One for stack.

One for local $node.

= 3

What is wrong?

Thanks. Dmitry.

> -----Original Message-----
> From: Derick Rethans [mailto:derick@derickrethans.nl] 
> Sent: Friday, May 27, 2005 4:21 PM
> To: dmitry@zend.com
> Cc: Marcus Brg; Andi Gutmans; PHP Developers Mailing List
> Subject: Another Interesting Reference Issue
> 
> 
> Hello,
> 
> I encountered a strange increase of the refcount with the following 
> script:
> 
> <?php
> 	error_reporting(E_ALL);
> 	$tree = array (
> 		1 => 'one',
> 		2 => 'two',
> 		3 => 'three'
> 	);
> 
> 	function &find_node($key, &$node)
> 	{
> 		xdebug_debug_zval('node');
> 		$item =& $node[$key];
> 		return $item;
> 	}
> 
> 	$node =& find_node(3, $tree);
> 	$node = 'drie';
> 
> The xdebug_debug_zval() function looks up the given symbol in 
> the symbol 
> table, and it prints it's refcount/is_ref value too (unlike the 
> `debug_zval_dump()` function available in PHP which actually modifies 
> those values). Logically you expect the refcount of $node to 
> be 2 (once 
> through the global var $tree, and once as local variable 
> $node. But the 
> refcount actually seems to be 3.
> 
> I've been tracing things in the engine and found the following places 
> where the refcount of this variable is modified (file/line 
> nos are from 
> php 5.0-dev):
> 
> Old value = 1
> New value = 2
> zend_send_ref_handler (execute_data=0xbfffd410, 
> opline=0x85f5440, op_array=0x85f0b64) at 
> /dat/dev/php/php-5.0dev/Zend/zend_execute.c:3077
> 3077            zend_ptr_stack_push(&EG(argument_stack), varptr);
> (gdb) bt
> #0  zend_send_ref_handler (execute_data=0xbfffd410, 
> opline=0x85f5440, op_array=0x85f0b64) 
>     at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:3077
> #1  0x0831de66 in execute (op_array=0x85f0b64) at 
> /dat/dev/php/php-5.0dev/Zend/zend_execute.c:1415
> 
> 
> Old value = 2
> New value = 3
> 0x0831c192 in zend_assign_to_variable_reference (result=0x0, 
> variable_ptr_ptr=0x85f74c8, value_ptr_ptr=0x85e4b8c, Ts=0x0) 
> at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:262
> 262                     value_ptr->refcount++;
> (gdb) bt
> #0  0x0831c192 in zend_assign_to_variable_reference 
> (result=0x0, variable_ptr_ptr=0x85f74c8, 
> value_ptr_ptr=0x85e4b8c, Ts=0x0)
>     at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:262
> #1  0x083227d7 in zend_recv_handler (execute_data=0xbfffd1a0, 
> opline=0x85f63bc, op_array=0x85f7a18)
>     at /dat/dev/php/php-5.0dev/Zend/zend_execute.c:3109
> #2  0x0831de66 in execute (op_array=0x85f7a18) at 
> /dat/dev/php/php-5.0dev/Zend/zend_execute.c:1415
> 
> It does not matter if it's passed by reference or not - the value is 
> always 3 inside the function. What is the reason for this?
> 
> regards,
> Derick
> 
> -- 
> Derick Rethans
> http://derickrethans.nl | http://ez.no | http://xdebug.org
