From f61b9bac526a7accdfd1460ba4c35ecf68b3ed6e Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@php.net>
Date: Thu, 1 Sep 2005 10:55:05 +0000
Subject: [PATCH] Fixed bug #34310 (foreach($arr as $c->d => $x) crashes)

---
 NEWS                     |  1 +
 Zend/tests/bug34310.phpt |  2 +-
 Zend/zend_compile.c      | 10 ++++++++--
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/NEWS b/NEWS
index c881bce6a7..f1d7939e88 100644
--- a/NEWS
+++ b/NEWS
@@ -19,6 +19,7 @@ PHP                                                                        NEWS
   defined using reflection API. (Johannes)
 - Fixed a bug where stream_get_meta_data() did not return the "uri" element for
   files opened with tmpname(). (Derick)
+- Fixed bug #34310 (foreach($arr as $c->d => $x) crashes). (Dmitry)
 - Fixed bug #34302 (date('W') do not return leading zeros for week 1 to 9).
   (Derick)
 - Fixed bug #33957 (gmdate('W')/date('W') sometimes returns wrong week number).
diff --git a/Zend/tests/bug34310.phpt b/Zend/tests/bug34310.phpt
index 2f7c477149..1d2bb03ad3 100644
--- a/Zend/tests/bug34310.phpt
+++ b/Zend/tests/bug34310.phpt
@@ -5,7 +5,7 @@ Bug #34310 (foreach($arr as $c->d => $x) crashes)
 
 class C
 {
-	var $d;
+	public $d;
 }
 
 $c = new C();
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 2c078284c2..606e4a9090 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -572,14 +572,20 @@ void zend_do_assign(znode *result, znode *variable, znode *value TSRMLS_DC)
 	if (last_op_number > 0) {
 		zend_op *last_op = &CG(active_op_array)->opcodes[last_op_number-1];
 
-		if (last_op->opcode == ZEND_FETCH_OBJ_W) {
+		if (variable->op_type == IS_VAR &&
+		    last_op->opcode == ZEND_FETCH_OBJ_W &&
+		    last_op->result.op_type == IS_VAR &&
+		    last_op->result.u.var == variable->u.var) {
 			last_op->opcode = ZEND_ASSIGN_OBJ;
 
 			zend_do_op_data(opline, value TSRMLS_CC);
 			SET_UNUSED(opline->result);
 			*result = last_op->result;
 			return;
-		} else if (last_op->opcode == ZEND_FETCH_DIM_W) {
+		} else if (variable->op_type == IS_VAR &&
+		           last_op->opcode == ZEND_FETCH_DIM_W &&
+		           last_op->result.op_type == IS_VAR &&
+		           last_op->result.u.var == variable->u.var) {
 			last_op->opcode = ZEND_ASSIGN_DIM;
 
 			zend_do_op_data(opline, value TSRMLS_CC);
-- 
2.50.1