- Fixed bug #46749 (Crash when repeatedly attempting to assign to property of non...

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 5e515aa532c47f50eb5abf426a26f4f1394e781b..74ebb354b5a7f84988bff3be58ee374743305914 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -598,11 +598,6 @@ static inline void zend_assign_to_object(znode *result, zval **object_ptr, zval
                                *retval = EG(uninitialized_zval_ptr);
                                PZVAL_LOCK(*retval);
                        }
-                       if (value_op->op_type == IS_TMP_VAR) {
-                               FREE_ZVAL(value);
-                       } else if (value_op->op_type == IS_CONST) {
-                               zval_ptr_dtor(&value);
-                       }
                        FREE_OP(free_value);
                        return;
                }
@@ -638,6 +633,11 @@ static inline void zend_assign_to_object(znode *result, zval **object_ptr, zval
                                *retval = EG(uninitialized_zval_ptr);
                                PZVAL_LOCK(*retval);
                        }
+                       if (value_op->op_type == IS_TMP_VAR) {
+                               FREE_ZVAL(value);
+                       } else if (value_op->op_type == IS_CONST) {
+                               zval_ptr_dtor(&value);
+                       }
                        FREE_OP(free_value);
                        return;
                }