The correction for the situation when a method or function having sta…

…tic variables in itself and copied by runkit crashes afterwards on calling if the original method or function was removed.

This change corrects copying of static variables and adds the test for the described behaviour.

runkit_functions.c

@@ -122,8 +122,8 @@ void php_runkit_function_copy_ctor(zend_function *fe, char *newname)
 		zval tmpZval;
 
 		ALLOC_HASHTABLE(tmpHash);
-		zend_hash_init(tmpHash, 2, NULL, ZVAL_PTR_DTOR, 0);
-		zend_hash_copy(tmpHash, fe->op_array.static_variables, ZVAL_COPY_CTOR, &tmpZval, sizeof(zval));
+		zend_hash_init(tmpHash, zend_hash_num_elements(fe->op_array.static_variables), NULL, ZVAL_PTR_DTOR, 0);
+		zend_hash_copy(tmpHash, fe->op_array.static_variables, (copy_ctor_func_t) zval_add_ref, (void*) &tmpZval, sizeof(zval*));
 		fe->op_array.static_variables = tmpHash;
 	}
 

tests/static_vars.phpt

@@ -0,0 +1,28 @@
+--TEST--
+redefining methods with static variables
+--SKIPIF--
+<?php if(!extension_loaded("runkit") || !RUNKIT_FEATURE_MANIPULATION) print "skip"; ?>
+--INI--
+error_reporting=E_ALL
+display_errors=on
+--FILE--
+<?php
+
+class A {
+    public function m() {
+        static $a = 0;
+        $a++;
+        return $a;
+    }
+}
+
+echo A::m(), "\n";
+
+runkit_method_copy('A', 'm1', 'A', 'm');
+runkit_method_remove('A', 'm');
+
+echo A::m1();
+?>
+--EXPECT--
+1
+2