Index: /branches/1.2/xcache_globals.h
===================================================================
--- /branches/1.2/xcache_globals.h	(revision 367)
+++ /branches/1.2/xcache_globals.h	(revision 378)
@@ -16,4 +16,7 @@
 	long   var_ttl;
 	zend_bool auth_enabled;
+
+	HashTable internal_function_table;
+	HashTable internal_class_table;
 ZEND_END_MODULE_GLOBALS(xcache)
 
Index: /branches/1.2/NEWS
===================================================================
--- /branches/1.2/NEWS	(revision 377)
+++ /branches/1.2/NEWS	(revision 378)
@@ -8,4 +8,5 @@
  * #86: remove/edit variable in admin page
  * fixed #77: hits/misses was not updated
+ * fixed #59: pass by reference for internal function was broken
  * fixed #56: xcache_set segfaults when xcache.var_size=0
  
Index: /branches/1.2/xcache.c
===================================================================
--- /branches/1.2/xcache.c	(revision 377)
+++ /branches/1.2/xcache.c	(revision 378)
@@ -1023,12 +1023,14 @@
 		Bucket *b;
 		unsigned int i;
+		unsigned int j;
 
 #define COPY_H(vartype, var, cnt, name, datatype) do {        \
-	for (i = 0; b; i ++, b = b->pListNext) {                  \
-		vartype *data = &php.var[i];                          \
+	for (i = 0, j = 0; b; i ++, b = b->pListNext) {           \
+		vartype *data = &php->var[j];                         \
                                                               \
 		if (i < old_##cnt) {                                  \
 			continue;                                         \
 		}                                                     \
+		j ++;                                                 \
                                                               \
 		assert(i < old_##cnt + php.cnt);                      \
@@ -1443,4 +1445,14 @@
 	int i;
 
+	if (XG(internal_function_table).nTableSize == 0) {
+		zend_function tmp_func;
+		xc_cest_t tmp_cest;
+
+		zend_hash_init_ex(&XG(internal_function_table), 100, NULL, NULL, 1, 0);
+		zend_hash_copy(&XG(internal_function_table), CG(function_table), (copy_ctor_func_t) function_add_ref, &tmp_func, sizeof(tmp_func));
+
+		zend_hash_init_ex(&XG(internal_class_table), 10, NULL, NULL, 1, 0);
+		zend_hash_copy(&XG(internal_class_table), CG(class_table), (copy_ctor_func_t) xc_zend_class_add_ref, &tmp_cest, sizeof(tmp_cest));
+	}
 	if (xc_php_hcache.size && !XG(php_holds)) {
 		XG(php_holds) = calloc(xc_php_hcache.size, sizeof(xc_stack_t));
@@ -1516,4 +1528,7 @@
 		xcache_globals->var_holds = NULL;
 	}
+
+	zend_hash_destroy(&xcache_globals->internal_function_table);
+	zend_hash_destroy(&xcache_globals->internal_class_table);
 }
 /* }}} */
Index: /branches/1.2/utils.c
===================================================================
--- /branches/1.2/utils.c	(revision 295)
+++ /branches/1.2/utils.c	(revision 378)
@@ -1,4 +1,6 @@
 
 #include "xcache.h"
+#include "stack.h"
+#include "xcache_globals.h"
 #include "utils.h"
 #ifdef ZEND_ENGINE_2_1
@@ -534,7 +536,18 @@
 /* }}} */
 #endif
+
+void xc_zend_class_add_ref(zend_class_entry ZESW(*ce, **ce))
+{
+#ifdef ZEND_ENGINE_2
+	(*ce)->refcount++;
+#else
+	(*ce->refcount)++;
+#endif
+}
+
 xc_sandbox_t *xc_sandbox_init(xc_sandbox_t *sandbox, char *filename TSRMLS_DC) /* {{{ */
 {
 	HashTable *h;
+
 	if (sandbox) {
 		memset(sandbox, 0, sizeof(sandbox[0]));
@@ -573,6 +586,20 @@
 	h = OG(function_table);
 	zend_hash_init_ex(&TG(function_table), 128, NULL, h->pDestructor, h->persistent, h->bApplyProtection);
+	{
+		zend_function tmp_func;
+		zend_hash_copy(&TG(function_table), &XG(internal_function_table), (copy_ctor_func_t) function_add_ref, (void *) &tmp_func, sizeof(tmp_func));
+	}
+	TG(internal_class_tail) = TG(function_table).pListTail;
+
 	h = OG(class_table);
 	zend_hash_init_ex(&TG(class_table),     16, NULL, h->pDestructor, h->persistent, h->bApplyProtection);
+#if 0 && TODO
+	{
+		xc_cest_t tmp_cest;
+		zend_hash_copy(&TG(class_table), &XG(internal_class_table), (copy_ctor_func_t) xc_zend_class_add_ref, (void *) &tmp_cest, sizeof(tmp_cest));
+	}
+#endif
+	TG(internal_class_tail) = TG(class_table).pListTail;
+
 #ifdef ZEND_ENGINE_2_1
 	/* shallow copy, don't destruct */
@@ -619,5 +646,5 @@
 #endif
 
-	b = TG(function_table).pListHead;
+	b = TG(internal_function_tail) ? TG(internal_function_tail)->pListNext : TG(function_table).pListHead;
 	/* install function */
 	while (b != NULL) {
@@ -628,5 +655,5 @@
 	}
 
-	b = TG(class_table).pListHead;
+	b = TG(internal_class_tail) ? TG(internal_class_tail)->pListNext : TG(class_table).pListHead;
 	/* install class */
 	while (b != NULL) {
Index: /branches/1.2/utils.h
===================================================================
--- /branches/1.2/utils.h	(revision 268)
+++ /branches/1.2/utils.h	(revision 378)
@@ -53,6 +53,9 @@
 	HashTable tmp_class_table;
 	HashTable tmp_auto_globals;
+	Bucket    *tmp_internal_function_tail;
+	Bucket    *tmp_internal_class_tail;
 } xc_sandbox_t;
 
+void xc_zend_class_add_ref(zend_class_entry ZESW(*ce, **ce));
 xc_sandbox_t *xc_sandbox_init(xc_sandbox_t *sandbox, char *filename TSRMLS_DC);
 void xc_sandbox_free(xc_sandbox_t *sandbox, int install TSRMLS_DC);