That's a more thorough fix...

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 839495497586730728ddde0d4caa414b710e5343..80f325fb2171b4521d892a231509bb8fe7aa7d05 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -688,7 +688,9 @@ static inline void zend_fetch_dimension_address(znode *result, znode *op1, znode
                                                convert_to_long(&tmp);
                                                offset = &tmp;
                                        }
-                                       SEPARATE_ZVAL(container_ptr);
+                                       if (!container->is_ref) {
+                                               SEPARATE_ZVAL(container_ptr);
+                                       }
                                        container = *container_ptr;
                                        Ts[result->u.var].EA.str = container;
                                        PZVAL_LOCK(container);