#34907 [NEW]: Segfault when overriding class vars in foreach loop

From: steemann at globalpark dot de Operating system: Linux 2.6.10-5-68 PHP version: 5.1.0RC3 PHP Bug Type: Scripting Engine problem Bug description: Segfault when overriding class vars in foreach loop Description: ------------ When assigning class variables to the results of a foreach loop and using the variables inside the loop, I am getting a segfault in 5.1RC3. The problem occurs for class variables only. When doing the same with local variables, it does not crash. It also does not crash if the $this->vars["one"] is not used inside the foreach loop. If the foreach loop is used without setting the key for the result it also won't crash, e.g.: foreach $foo as $this->vars["two"] instead of foreach $foo as $this->vars["one"]=>$this->vars["two"] won't crash. I know code like this should never be written but Smarty actually does a lot of stuff like this so it won't work with 5.1.0RC3. Reproduce code: --------------- class x { function run() { $foo=array("0","1"); foreach ($foo as $this->vars["one"]=>$this->vars["two"]) var_dump($this->vars["one"]); } } $x=new x; $x->run(); Expected result: ---------------- in PHP 5.1.0b3: int(0) int(1) Actual result: -------------- in PHP 5.1.0RC3: int(0) NULL Speicherzugriffsfehler (segmentation fault) -- Edit bug report at http://bugs.php.net/?id=34907&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=34907&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=34907&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=34907&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=34907&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=34907&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=34907&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=34907&r=needscript Try newer version: http://bugs.php.net/fix.php?id=34907&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=34907&r=support Expected behavior: http://bugs.php.net/fix.php?id=34907&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=34907&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=34907&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=34907&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=34907&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=34907&r=dst IIS Stability: http://bugs.php.net/fix.php?id=34907&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=34907&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=34907&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=34907&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=34907&r=mysqlcfg