Fixed bug #33710 (ArrayAccess objects doen't initialize $this)

3 files changed, 45 insertions, 38 deletions

diff --git a/NEWS b/NEWS
index 1554ab503b..f5e2eb73fb 100644
--- a/NEWS
+++ b/NEWS
@@ -1,9 +1,11 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2005, PHP 5.1
+- Fixed bug #33710 (ArrayAccess objects doen't initialize $this). (Dmitry)
 - Fixed bug #33558 (warning with nested calls to functions returning by
   reference). (Dmitry)
 
+
 14 Jul 2005, PHP 5.1 Beta 3
 - Upgraded bundled SQLite library for PDO:SQLite to 3.2.2 (Ilia)
 - Moved extensions to PECL:
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index d4f8abbd47..25805bf0d0 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -847,7 +847,6 @@ void zend_do_end_variable_parse(int type, int arg_offset TSRMLS_DC)
 	zend_llist *fetch_list_ptr;
 	zend_llist_element *le;
 	zend_op *opline, *opline_ptr=NULL;
-	int num_of_created_opcodes = 0;
 
 	zend_stack_top(&CG(bp_stack), (void **) &fetch_list_ptr);
 
@@ -855,47 +854,49 @@ void zend_do_end_variable_parse(int type, int arg_offset TSRMLS_DC)
 
 	/* TODO: $foo->x->y->z = 1 should fetch "x" and "y" for R or RW, not just W */
 	
-	while (le) {
+	if (le) {
 		opline_ptr = (zend_op *)le->data;
-		opline = get_next_op(CG(active_op_array) TSRMLS_CC);
-		memcpy(opline, opline_ptr, sizeof(zend_op));
-		switch (type) {
-			case BP_VAR_R:
-				if (opline->opcode == ZEND_FETCH_DIM_W && opline->op2.op_type == IS_UNUSED) {
-					zend_error(E_COMPILE_ERROR, "Cannot use [] for reading");
-				}
-				opline->opcode -= 3;
-				break;
-			case BP_VAR_W:
-				break;
-			case BP_VAR_RW:
-				opline->opcode += 3;
-				break;
-			case BP_VAR_IS:
-				if (opline->opcode == ZEND_FETCH_DIM_W && opline->op2.op_type == IS_UNUSED) {
-					zend_error(E_COMPILE_ERROR, "Cannot use [] for reading");
-				}
-				opline->opcode += 6; /* 3+3 */
-				break;
-			case BP_VAR_FUNC_ARG:
-				opline->opcode += 9; /* 3+3+3 */
-				opline->extended_value = arg_offset;
-				break;
-			case BP_VAR_UNSET:
-				if (opline->opcode == ZEND_FETCH_DIM_W && opline->op2.op_type == IS_UNUSED) {
-					zend_error(E_COMPILE_ERROR, "Cannot use [] for unsetting");
-				}
-				opline->opcode += 12; /* 3+3+3+3 */
-				break;
+		if (opline_is_fetch_this(opline_ptr TSRMLS_CC)) {
+			CG(active_op_array)->uses_this = 1;
 		}
-		le = le->next;
-		num_of_created_opcodes++;
-	}
 
-	if (num_of_created_opcodes == 1 && opline_is_fetch_this(opline_ptr TSRMLS_CC)) {
-		CG(active_op_array)->uses_this = 1;
+		while (1) {
+			opline = get_next_op(CG(active_op_array) TSRMLS_CC);
+			memcpy(opline, opline_ptr, sizeof(zend_op));
+			switch (type) {
+				case BP_VAR_R:
+					if (opline->opcode == ZEND_FETCH_DIM_W && opline->op2.op_type == IS_UNUSED) {
+						zend_error(E_COMPILE_ERROR, "Cannot use [] for reading");
+					}
+					opline->opcode -= 3;
+					break;
+				case BP_VAR_W:
+					break;
+				case BP_VAR_RW:
+					opline->opcode += 3;
+					break;
+				case BP_VAR_IS:
+					if (opline->opcode == ZEND_FETCH_DIM_W && opline->op2.op_type == IS_UNUSED) {
+						zend_error(E_COMPILE_ERROR, "Cannot use [] for reading");
+					}
+					opline->opcode += 6; /* 3+3 */
+					break;
+				case BP_VAR_FUNC_ARG:
+					opline->opcode += 9; /* 3+3+3 */
+					opline->extended_value = arg_offset;
+					break;
+				case BP_VAR_UNSET:
+					if (opline->opcode == ZEND_FETCH_DIM_W && opline->op2.op_type == IS_UNUSED) {
+						zend_error(E_COMPILE_ERROR, "Cannot use [] for unsetting");
+					}
+					opline->opcode += 12; /* 3+3+3+3 */
+					break;
+			}
+			le = le->next;
+			if (le == NULL) break;
+			opline_ptr = (zend_op *)le->data;
+		}
 	}
-
 	zend_llist_destroy(fetch_list_ptr);
 	zend_stack_del_top(&CG(bp_stack));
 }
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 2bd65b5de1..ea7cc801ca 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1137,6 +1137,10 @@ static void zend_fetch_dimension_address(temp_variable *result, zval **container
 					result->var.ptr_ptr = retval;
 					AI_USE_PTR(result->var);
 					PZVAL_LOCK(*result->var.ptr_ptr);
+				} else if ((*retval)->refcount == 0) {
+					/* Destroy unused result from offsetGet() magic method */
+					(*retval)->refcount = 1;
+					zval_ptr_dtor(retval);
 				}
 				if (dim_is_tmp_var) {
 					zval_ptr_dtor(&dim);