From 61099f85857193c223dd62b0c5302507a77cf0ab Mon Sep 17 00:00:00 2001
From: Mike Willbanks <mike@digitalstruct.com>
Date: Fri, 22 Feb 2013 13:05:38 -0800
Subject: [PATCH] Bug #52861: unset fails with ArrayObject and deep arrays

When checking to make into a reference write, readwrite are checked but not unset
---
 NEWS                        |  2 ++
 ext/spl/spl_array.c         |  2 +-
 ext/spl/tests/bug52861.phpt | 22 ++++++++++++++++++++++
 3 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 ext/spl/tests/bug52861.phpt

#diff --git a/NEWS b/NEWS
#index a298c55..57bae92 100644
#--- a/NEWS
#+++ b/NEWS
#@@ -6,6 +6,8 @@ PHP                                                                        NEWS
#   . Fixed bug #64264 (SPLFixedArray toArray problem). (Laruence)
#   . Fixed bug #64228 (RecursiveDirectoryIterator always assumes SKIP_DOTS).
#     (patch by kriss@krizalys.com, Laruence)
#+  . Fixed bug #52861 (unset fails with ArrayObject and deep arrays). 
#+    (Mike Willbanks)
# 
# 21 Feb 2013, PHP 5.3.22
# 
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 7d6f314..77453d6 100644
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -408,7 +408,7 @@ static zval *spl_array_read_dimension_ex(int check_inherited, zval *object, zval
 	/* When in a write context,
 	 * ZE has to be fooled into thinking this is in a reference set
 	 * by separating (if necessary) and returning as an is_ref=1 zval (even if refcount == 1) */
-	if ((type == BP_VAR_W || type == BP_VAR_RW) && !Z_ISREF_PP(ret)) {
+	if ((type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET) && !Z_ISREF_PP(ret)) {
 		if (Z_REFCOUNT_PP(ret) > 1) {
 			zval *newval;
 
diff --git a/ext/spl/tests/bug52861.phpt b/ext/spl/tests/bug52861.phpt
new file mode 100644
index 0000000..30a3261
--- /dev/null
+++ b/ext/spl/tests/bug52861.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #52861 (unset failes with ArrayObject and deep arrays)
+--FILE--
+<?php
+$arrayObject = new ArrayObject(array('foo' => array('bar' => array('baz' => 'boo'))));
+
+unset($arrayObject['foo']['bar']['baz']);
+print_r($arrayObject->getArrayCopy());
+?>
+--EXPECT--
+Array
+(
+    [foo] => Array
+        (
+            [bar] => Array
+                (
+                )
+
+        )
+
+)
+
-- 
1.7.11.5