5 files changed, 60 insertions, 14 deletions

diff --git a/Zend/tests/bug27798.phpt b/Zend/tests/bug27798.phpt
index f0d1cd5e99..9e54efa833 100755
--- a/Zend/tests/bug27798.phpt
+++ b/Zend/tests/bug27798.phpt
@@ -49,12 +49,12 @@ array(1) {
 }
 Base::__construct
 array(3) {
-  ["Baz"]=>
-  int(4)
   ["Foo"]=>
   int(1)
   ["Bar"]=>
   int(2)
+  ["Baz"]=>
+  int(3)
 }
 Child::__construct
 array(3) {
diff --git a/Zend/tests/bug40757.phpt b/Zend/tests/bug40757.phpt
new file mode 100755
index 0000000000..b5c91c79ce
--- /dev/null
+++ b/Zend/tests/bug40757.phpt
@@ -0,0 +1,28 @@
+--TEST--
+Bug #40757 (get_object_vars() get nothing in child class)
+--FILE--
+<?php
+class Base {
+  private $p1='sadf';
+
+  function getFields($obj){
+    return get_object_vars($obj);
+  }
+}
+
+class Child extends Base { }
+
+$base=new Base();
+print_r($base->getFields(new Base()));
+$child=new Child();
+print_r($child->getFields(new Base()));
+?>
+--EXPECT--
+Array
+(
+    [p1] => sadf
+)
+Array
+(
+    [p1] => sadf
+)
diff --git a/Zend/tests/bug41929.phpt b/Zend/tests/bug41929.phpt
new file mode 100755
index 0000000000..cdca5ffd61
--- /dev/null
+++ b/Zend/tests/bug41929.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #41929 Foreach on object does not iterate over all visible properties 
+--FILE--
+<?php
+class C {
+  private $priv = "ok";
+
+  function doLoop() {
+    echo $this->priv,"\n";
+    foreach ($this as $k=>$v) {
+      echo "$k: $v\n";
+    }
+  } 
+}
+
+class D extends C {
+}
+
+$myD = new D;
+$myD->doLoop();
+?>
+--EXPECT--
+ok
+priv: ok
diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
index 785709f51b..0d45d5a32e 100644
--- a/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@ -789,7 +789,7 @@ ZEND_FUNCTION(get_object_vars)
 	char *key, *prop_name, *class_name;
 	uint key_len;
 	ulong num_index;
-	int instanceof;
+	zend_object *zobj;
 
 	if (ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &obj) == FAILURE) {
 		ZEND_WRONG_PARAM_COUNT();
@@ -808,7 +808,7 @@ ZEND_FUNCTION(get_object_vars)
 		RETURN_FALSE;
 	}
 
-	instanceof = EG(This) && instanceof_function(Z_OBJCE_P(EG(This)), Z_OBJCE_PP(obj) TSRMLS_CC);
+	zobj = zend_objects_get_address(*obj TSRMLS_CC);
 
 	array_init(return_value);
 
@@ -816,17 +816,11 @@ ZEND_FUNCTION(get_object_vars)
 
 	while (zend_hash_get_current_data_ex(properties, (void **) &value, &pos) == SUCCESS) {
 		if (zend_hash_get_current_key_ex(properties, &key, &key_len, &num_index, 0, &pos) == HASH_KEY_IS_STRING) {
-			if (key[0]) {
+			if (zend_check_property_access(zobj, key, key_len-1 TSRMLS_CC) == SUCCESS) {
+				zend_unmangle_property_name(key, key_len-1, &class_name, &prop_name);
 				/* Not separating references */
 				(*value)->refcount++;
-				add_assoc_zval_ex(return_value, key, key_len, *value);
-			} else if (instanceof) {
-				zend_unmangle_property_name(key, key_len-1, &class_name, &prop_name);
-				if (!memcmp(class_name, "*", 2) || (Z_OBJCE_P(EG(This)) == Z_OBJCE_PP(obj) && !strcmp(Z_OBJCE_P(EG(This))->name, class_name))) {
-					/* Not separating references */
-					(*value)->refcount++;
-					add_assoc_zval_ex(return_value, prop_name, strlen(prop_name)+1, *value);
-				}
+				add_assoc_zval_ex(return_value, prop_name, strlen(prop_name)+1, *value);
 			}
 		}
 		zend_hash_move_forward_ex(properties, &pos);
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index 325675a0ea..901c28ce68 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -152,7 +152,7 @@ static int zend_verify_property_access(zend_property_info *property_info, zend_c
 		case ZEND_ACC_PROTECTED:
 			return zend_check_protected(property_info->ce, EG(scope));
 		case ZEND_ACC_PRIVATE:
-			if (ce==EG(scope) && EG(scope)) {
+			if ((ce==EG(scope) || property_info->ce == EG(scope)) && EG(scope)) {
 				return 1;
 			} else {
 				return 0;