- Indirect references had all of the fetches by mistakenly backpatched.

  Actually all of the fetches are supposed to be read, except for the last
  one.

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index a70120312c340b4ed8745c660c84d8590937215d..ed9dd1ec8a380f3c897be9c69a50b501b31e58c6 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -196,14 +196,13 @@ void do_fetch_globals(znode *varname CLS_DC)
        }
 }
 
-
-void fetch_simple_variable(znode *result, znode *varname, int bp CLS_DC)
+void fetch_simple_variable_ex(znode *result, znode *varname, int bp, int op CLS_DC)
 {
        int next_op_number = get_next_op_number(CG(active_op_array));
        zend_op *opline = get_next_op(CG(active_op_array) CLS_CC);
        zend_llist *fetch_list_ptr;
 
-       opline->opcode = ZEND_FETCH_W;          /* the default mode must be Write, since fetch_simple_variable() is used to define function arguments */
+       opline->opcode = op;
        opline->result.op_type = IS_VAR;
        opline->result.u.EA.type = 0;
        opline->result.u.var = get_temporary_variable(CG(active_op_array));
@@ -218,6 +217,12 @@ void fetch_simple_variable(znode *result, znode *varname, int bp CLS_DC)
        }
 }
 
+void fetch_simple_variable(znode *result, znode *varname, int bp CLS_DC)
+{
+       /* the default mode must be Write, since fetch_simple_variable() is used to define function arguments */
+       fetch_simple_variable_ex(result, varname, bp, ZEND_FETCH_W CLS_CC);
+}
+
 
 void fetch_array_begin(znode *result, znode *varname, znode *first_dim CLS_DC)
 {
@@ -1799,10 +1804,13 @@ void do_indirect_references(znode *result, znode *num_references, znode *variabl
 {
        int i;
 
-       for (i=1; i<=num_references->u.constant.value.lval; i++) {
-               fetch_simple_variable(result, variable, 1 CLS_CC);
+       do_end_variable_parse(BP_VAR_R CLS_CC);
+       for (i=1; i<num_references->u.constant.value.lval; i++) {
+               fetch_simple_variable_ex(result, variable, 0, ZEND_FETCH_R CLS_CC);
                *variable = *result;
        }
+       do_begin_variable_parse(CLS_C);
+       fetch_simple_variable(result, variable, 1 CLS_CC);
 }
 
 

diff --git a/Zend/zend_compile.h b/Zend/zend_compile.h
index 7b9a6421915efd9445947048f3fd28a9cb008e09..e69e32d577e3a6055e0fdc529577c850800e9257 100644 (file)
--- a/Zend/zend_compile.h
+++ b/Zend/zend_compile.h
@@ -219,6 +219,7 @@ void do_binary_assign_op(int op, znode *result, znode *op1, znode *op2 CLS_DC);
 void do_assign(znode *result, znode *variable, znode *value CLS_DC);
 void do_assign_ref(znode *result, znode *lvar, znode *rvar CLS_DC);
 void fetch_simple_variable(znode *result, znode *varname, int bp CLS_DC);
+void fetch_simple_variable_ex(znode *result, znode *varname, int bp, int op CLS_DC);
 void do_indirect_references(znode *result, znode *num_references, znode *variable CLS_DC);
 void do_fetch_global_or_static_variable(znode *varname, znode *static_assignment, int fetch_type CLS_DC);
 void do_fetch_globals(znode *varname CLS_DC);