- Fix crash in:

<?php
  class Foo {
    public $attributes=  array();

    function export() {
      foreach ($this->attributes as $name => $attr) {
      }
    }
  }

  $f= new Foo();
  $f->export();
?>

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 5caf910e4abb54f4af0cf6207691dcd41865adba..04334742eb8584d7cc2176d000657123e9df86d9 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -3275,9 +3275,11 @@ void zend_do_foreach_begin(znode *foreach_token, znode *array, znode *open_brack
                }
                zend_do_end_variable_parse(BP_VAR_W, 0 TSRMLS_CC);
                if (CG(active_op_array)->opcodes[CG(active_op_array)->last-1].opcode == ZEND_FETCH_OBJ_W) {
-                       /* FIXME:  This will cause a leak, we have to unlock at the end of foreach() */
-                       CG(active_op_array)->opcodes[CG(active_op_array)->last-1].extended_value |= ZEND_FETCH_ADD_LOCK;
-                       push_container = 1;
+                       /* Only lock the container if we are fetching from a real container and not $this */
+                       if (CG(active_op_array)->opcodes[CG(active_op_array)->last-1].op1.op_type == IS_VAR) {
+                               CG(active_op_array)->opcodes[CG(active_op_array)->last-1].extended_value |= ZEND_FETCH_ADD_LOCK;
+                               push_container = 1;
+                       }
                }
        } else {
                is_variable = 0;