Index: ext/spl/spl_array.c
===================================================================
RCS file: /repository/php-src/ext/spl/spl_array.c,v
retrieving revision 1.140
diff -u -p -r1.140 spl_array.c
--- ext/spl/spl_array.c	6 Jul 2008 23:45:38 -0000	1.140
+++ ext/spl/spl_array.c	19 Jul 2008 13:08:22 -0000
@@ -1235,11 +1235,11 @@ static void spl_array_method(INTERNAL_FU
 {
 	spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	HashTable *aht = spl_array_get_hash_table(intern, 0 TSRMLS_CC);
-	zval tmp, *arg;
+	zval *tmp, *arg;
 	
-	INIT_PZVAL(&tmp);
-	Z_TYPE(tmp) = IS_ARRAY;
-	Z_ARRVAL(tmp) = aht;
+	MAKE_STD_ZVAL(tmp);
+	Z_TYPE_P(tmp) = IS_ARRAY;
+	Z_ARRVAL_P(tmp) = aht;
 	
 	if (use_arg) {
 		if (ZEND_NUM_ARGS() != 1 || zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS() TSRMLS_CC, "z", &arg) == FAILURE) {
@@ -1247,11 +1247,13 @@ static void spl_array_method(INTERNAL_FU
 			return;
 		}
 		zval_ptr_dtor(return_value_ptr);
-		zend_call_method(NULL, NULL, NULL, fname, fname_len, return_value_ptr, 2, &tmp, arg TSRMLS_CC);
+		zend_call_method(NULL, NULL, NULL, fname, fname_len, return_value_ptr, 2, tmp, arg TSRMLS_CC);
 	} else {
 		zval_ptr_dtor(return_value_ptr);
-		zend_call_method(NULL, NULL, NULL, fname, fname_len, return_value_ptr, 1, &tmp, NULL TSRMLS_CC);
+		zend_call_method(NULL, NULL, NULL, fname, fname_len, return_value_ptr, 1, tmp, NULL TSRMLS_CC);
 	}
+	Z_TYPE_P(tmp) = IS_NULL; /* we want to destroy the zval, not the hashtable */
+	zval_ptr_dtor(&tmp);
 } /* }}} */
 
 /* {{{ SPL_ARRAY_METHOD */