Fixed bug #62616 (ArrayIterator::count() from IteratorIterator instance gives Segmentation fault)

Author: laruence

NEWS

@@ -32,6 +32,8 @@ PHP                                                                        NEWS
   . Implemented FR #55218 Get namespaces from current node. (Lonny)
 
 - SPL:
+  . Fixed bug #62616 (ArrayIterator::count() from IteratorIterator instance
+    gives Segmentation fault). (Laruence, Gustavo)
   . Fixed bug #61527 (ArrayIterator gives misleading notice on next() when 
     moved to the end). ([email protected])
 

ext/spl/spl_iterators.c

@@ -1289,6 +1289,8 @@ static union _zend_function *spl_dual_it_get_method(zval **object_ptr, char *met
 				*object_ptr = intern->inner.zobject;
 				function_handler = Z_OBJ_HT_P(*object_ptr)->get_method(object_ptr, method, method_len, key TSRMLS_CC);
 			}
+		} else {
+			*object_ptr = intern->inner.zobject;
 		}
 	}
 	return function_handler;

ext/spl/tests/bug62616.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #62616 (ArrayIterator::count() from IteratorIterator instance gives Segmentation fault)
+--FILE--
+<?php
+$ai = new ArrayIterator(array(0,1));
+
+var_dump($ai->count());
+
+$ii = new IteratorIterator($ai);
+
+var_dump($ii->count());
+?>
+--EXPECTF--
+int(2)
+int(2)