From: Nikita Popov <nikic@php.net>
Date: Sat, 6 Feb 2016 15:38:59 +0000 (+0100)
Subject: Fix bug #71529
X-Git-Tag: php-7.0.4RC1~38^2~8
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=9f82f21d018aafbfea723960a335f435202bff77;p=php

Fix bug #71529
---

diff --git a/NEWS b/NEWS
index a69e0707f2..5ea1dff38f 100644
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,8 @@ PHP                                                                        NEWS
   . Fixed bug #71442 (forward_static_call crash). (Laruence)
   . Fixed bug #71441 (Typehinted Generator with return in try/finally crashes).
     (Bob)
+  . Fixed bug #71529 (Variable references on array elements don't work when
+    using count). (Nikita)
 
 - CURL:
   . Fixed bug #71523 (Copied handle with new option CURLOPT_HTTPHEADER crashes
diff --git a/Zend/tests/bug71529.phpt b/Zend/tests/bug71529.phpt
new file mode 100644
index 0000000000..5a5e323414
--- /dev/null
+++ b/Zend/tests/bug71529.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #71529: Variable references on array elements don't work when using count
+--FILE--
+<?php
+
+$a = [1];
+$a[] = &$a[out(count($a) - 1)];
+var_dump($a);
+
+function out($what) {
+    var_dump($what);
+    return $what;
+}
+
+?>
+--EXPECT--
+int(0)
+array(2) {
+  [0]=>
+  &int(1)
+  [1]=>
+  &int(1)
+}
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 1c30b98a9f..58be2ed2e8 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -2589,14 +2589,17 @@ void zend_compile_assign_ref(znode *result, zend_ast *ast) /* {{{ */
 
 	znode target_node, source_node;
 	zend_op *opline;
+	uint32_t offset;
 
 	if (is_this_fetch(target_ast)) {
 		zend_error_noreturn(E_COMPILE_ERROR, "Cannot re-assign $this");
 	}
 	zend_ensure_writable_variable(target_ast);
 
-	zend_compile_var(&target_node, target_ast, BP_VAR_W);
-	zend_compile_var(&source_node, source_ast, BP_VAR_REF);
+	offset = zend_delayed_compile_begin();
+	zend_delayed_compile_var(&target_node, target_ast, BP_VAR_W);
+	zend_delayed_compile_var(&source_node, source_ast, BP_VAR_REF);
+	zend_delayed_compile_end(offset);
 
 	if (source_node.op_type != IS_VAR && zend_is_call(source_ast)) {
 		zend_error_noreturn(E_COMPILE_ERROR, "Cannot use result of built-in function in write context");