Fix bug #71529

diff --git a/NEWS b/NEWS
index a69e0707f22a1fb02e4150f2d83f4542c8f1b974..5ea1dff38f4a1e995c68edc42496a4fed561424c 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,8 @@ PHP                                                                        NEWS
   . Fixed bug #71442 (forward_static_call crash). (Laruence)
   . Fixed bug #71441 (Typehinted Generator with return in try/finally crashes).
     (Bob)
+  . Fixed bug #71529 (Variable references on array elements don't work when
+    using count). (Nikita)
 
 - CURL:
   . Fixed bug #71523 (Copied handle with new option CURLOPT_HTTPHEADER crashes

diff --git a/Zend/tests/bug71529.phpt b/Zend/tests/bug71529.phpt
new file mode 100644 (file)
index 0000000..5a5e323
--- /dev/null
+++ b/Zend/tests/bug71529.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #71529: Variable references on array elements don't work when using count
+--FILE--
+<?php
+
+$a = [1];
+$a[] = &$a[out(count($a) - 1)];
+var_dump($a);
+
+function out($what) {
+    var_dump($what);
+    return $what;
+}
+
+?>
+--EXPECT--
+int(0)
+array(2) {
+  [0]=>
+  &int(1)
+  [1]=>
+  &int(1)
+}

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 1c30b98a9f54b01b08df7fffe6745c8cb1cfcf2b..58be2ed2e884277ea7d70ec202dadb0fd438ebd6 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -2589,14 +2589,17 @@ void zend_compile_assign_ref(znode *result, zend_ast *ast) /* {{{ */
 
        znode target_node, source_node;
        zend_op *opline;
+       uint32_t offset;
 
        if (is_this_fetch(target_ast)) {
                zend_error_noreturn(E_COMPILE_ERROR, "Cannot re-assign $this");
        }
        zend_ensure_writable_variable(target_ast);
 
-       zend_compile_var(&target_node, target_ast, BP_VAR_W);
-       zend_compile_var(&source_node, source_ast, BP_VAR_REF);
+       offset = zend_delayed_compile_begin();
+       zend_delayed_compile_var(&target_node, target_ast, BP_VAR_W);
+       zend_delayed_compile_var(&source_node, source_ast, BP_VAR_REF);
+       zend_delayed_compile_end(offset);
 
        if (source_node.op_type != IS_VAR && zend_is_call(source_ast)) {
                zend_error_noreturn(E_COMPILE_ERROR, "Cannot use result of built-in function in write context");