- Fix bug #4120

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index edde8746e97c8858341759f5a5e98c8c22163cd1..abfc8d3723273ea9c2e0bb6596598f1493c2b7a1 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -823,10 +823,19 @@ void do_begin_dynamic_function_call(znode *function_name CLS_DC)
 {
        unsigned char *ptr = NULL;
        int last_op_number = get_next_op_number(CG(active_op_array))-1;
-
-       if (last_op_number>=0 && CG(active_op_array)->opcodes[last_op_number].opcode == ZEND_FETCH_OBJ_R) {
-               CG(active_op_array)->opcodes[last_op_number].opcode = ZEND_INIT_FCALL_BY_NAME;
-               CG(active_op_array)->opcodes[last_op_number].extended_value = ZEND_MEMBER_FUNC_CALL;
+       zend_op *last_op = &CG(active_op_array)->opcodes[last_op_number];
+
+       if ((last_op_number >= 1) && (last_op->opcode == ZEND_EXT_FCALL_BEGIN) && ((last_op-1)->opcode == ZEND_FETCH_OBJ_R)) {
+               zend_op tmp;
+
+               tmp = *last_op;
+               *last_op = *(last_op-1);
+               *(last_op-1) = tmp;
+               last_op->opcode = ZEND_INIT_FCALL_BY_NAME;
+                last_op->extended_value = ZEND_MEMBER_FUNC_CALL;
+       } else if (last_op_number>=0 && last_op->opcode == ZEND_FETCH_OBJ_R) {
+               last_op->opcode = ZEND_INIT_FCALL_BY_NAME;
+               last_op->extended_value = ZEND_MEMBER_FUNC_CALL;
        } else {
                zend_op *opline = get_next_op(CG(active_op_array) CLS_CC);