Fix bug #27876

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 147bf668b74ae2f371c1c4529964e9426b101186..82361d3e6d209ca15b1e378a0216857f260528ba 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -447,7 +447,7 @@ static inline void zend_assign_to_object(znode *result, zval **object_ptr, znode
        FREE_OP(Ts, op2, EG(free_op2));
        if (result) {
                T(result->u.var).var.ptr = value;
-               T(result->u.var).var.ptr_ptr = NULL; /* see if we can remove this */
+               T(result->u.var).var.ptr_ptr = &T(result->u.var).var.ptr; /* this is so that we could use it in FETCH_DIM_R, etc. - see bug #27876 */
                SELECTIVE_PZVAL_LOCK(value, result);
        }
        zval_ptr_dtor(&value);