Fix handling of object property assignments in switch expressions

(bug #23925)

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 9dfa6b5ee7e1efa55af4a2fd1ad846d33e6d5db1..1f4007e35c585779b9eec8d0d3235a0275d5b5fc 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -3054,13 +3054,12 @@ int zend_case_handler(ZEND_OPCODE_HANDLER_ARGS)
        int switch_expr_is_overloaded=0;
 
        if (EX(opline)->op1.op_type==IS_VAR) {
-               if (EX_T(EX(opline)->op1.u.var).var.ptr_ptr) {
-                       PZVAL_LOCK(*EX_T(EX(opline)->op1.u.var).var.ptr_ptr);
+               if (EX_T(EX(opline)->op1.u.var).var.ptr_ptr
+                       || (EX_T(EX(opline)->op1.u.var).var.ptr && EX_T(EX(opline)->op1.u.var).EA.type!=IS_STRING_OFFSET)) {
+                       PZVAL_LOCK(EX_T(EX(opline)->op1.u.var).var.ptr);
                } else {
                        switch_expr_is_overloaded = 1;
-                       if (EX_T(EX(opline)->op1.u.var).EA.type==IS_STRING_OFFSET) {
-                               EX_T(EX(opline)->op1.u.var).EA.data.str_offset.str->refcount++;
-                       }
+                       EX_T(EX(opline)->op1.u.var).EA.data.str_offset.str->refcount++;
                }
        }
        is_equal_function(&EX_T(EX(opline)->result.u.var).tmp_var,