Fix refcounting for $var = $obj[$idx] = $value;

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index bc82c668652a558a004fb5c74aa9b050f521bf48..3f658abd8a92aa3eace5b229588b2f71e82a9e35 100755 (executable)
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -224,6 +224,7 @@ ZEND_EXECUTE_HOOK_FUNCTION(ZEND_ASSIGN_DIM)
                                SELECTIVE_PZVAL_LOCK(value, &EX(opline)->result);
                                DELETE_RET_ZVAL(retval);                        
                        } else {
+                               SELECTIVE_PZVAL_LOCK(retval, &EX(opline)->result);
                                EX_T(EX(opline)->result.u.var).var.ptr = retval;
                                retval->refcount--;
                        }