- This hopefully fixes the list($a, $a) = array(1,2) crash, i.e. when list

  by mistake contains the same variable twice.
- BTW, there is no defined order of assignment. The value of $a after the
  previous example is undefined, and should not be assumed to be either 1
  nor 2.

diff --git a/Zend/zend-parser.y b/Zend/zend-parser.y
index a930bdfab0ca411fa03861e4557036f808d3e728..d5f851e1b77043f71a5d21b263d0f90d153a4701 100644 (file)
--- a/Zend/zend-parser.y
+++ b/Zend/zend-parser.y
@@ -644,7 +644,7 @@ assignment_list:
 
 
 assignment_list_element:
-               w_cvar                                                          { do_add_list_element(&$1 CLS_CC); }
+               cvar                                                            { do_add_list_element(&$1 CLS_CC); }
        |       T_LIST '(' { do_new_list_begin(CLS_C); } assignment_list ')'    { do_new_list_end(CLS_C); }
        |       /* empty */                                                     { do_add_list_element(NULL CLS_CC); }
 ;

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 1e9af037b3dd8490e9c53e63d140edc287bc8ec1..0ba66fa1f54f8b236d0192d53db1dda332b39e3e 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -1758,7 +1758,7 @@ void do_add_list_element(znode *element CLS_DC)
        if (element) {
                lle.var = *element;
                zend_llist_copy(&lle.dimensions, &CG(dimension_llist));
-               zend_llist_add_element(&CG(list_llist), &lle);
+               zend_llist_prepend_element(&CG(list_llist), &lle);
        }
        (*((int *)CG(dimension_llist).tail->data))++;
 }
@@ -1827,11 +1827,7 @@ void do_list_end(znode *result, znode *expr CLS_DC)
                }
                ((list_llist_element *) le->data)->value = last_container;
                zend_llist_destroy(&((list_llist_element *) le->data)->dimensions);
-               le = le->next;
-       }
-
-       le = CG(list_llist).head;
-       while (le) {
+               do_end_variable_parse(BP_VAR_W, 0 CLS_CC);
                do_assign(result, &((list_llist_element *) le->data)->var, &((list_llist_element *) le->data)->value CLS_CC);
                CG(active_op_array)->opcodes[CG(active_op_array)->last-1].result.u.EA.type |= EXT_TYPE_UNUSED;
                le = le->next;