Fixed bug #40899 (memory leak when nesting list())

NEWS

@@ -35,6 +35,7 @@ PHP                                                                        NEWS
 - Fixed zend_llist_remove_tail (Michael Wallner, Dmitry)
 - Fixed a thread safety issue in gd gif read code (Nuno, Roman Nemecek)
 - Fixed CVE-2007-1001, GD wbmp used with invalid image size (Pierre)
+- Fixed bug #40899 (memory leak when nesting list()). (Dmitry)
 - Fixed bug #40883 (mysql_query() is allocating memory incorrectly). (Tony)
 - Fixed bug #40872 (inconsistency in offsetSet, offsetExists treatment of 
   string enclosed integers). (Marcus)

Zend/tests/bug40899.phpt

@@ -0,0 +1,9 @@
+--TEST--
+Bug #40899 (memory leak when nesting list())
+--FILE--
+<?php
+list(list($a,$b),$c)=array(array('a','b'),'c');
+echo "$a$b$c\n";
+?>
+--EXPECT--
+abc

Zend/zend_compile.c

@@ -3423,6 +3423,7 @@ void zend_do_list_end(znode *result, znode *expr TSRMLS_DC)
 						opline->opcode = ZEND_FETCH_DIM_TMP_VAR;
 						break;
 				}
+				opline->extended_value = ZEND_FETCH_ADD_LOCK;
 			} else {
 				opline->opcode = ZEND_FETCH_DIM_R;
 			}
@@ -3434,7 +3435,6 @@ void zend_do_list_end(znode *result, znode *expr TSRMLS_DC)
 			Z_TYPE(opline->op2.u.constant) = IS_LONG;
 			Z_LVAL(opline->op2.u.constant) = *((int *) dimension->data);
 			INIT_PZVAL(&opline->op2.u.constant);
-			opline->extended_value = ZEND_FETCH_ADD_LOCK;
 			last_container = opline->result;
 			dimension = dimension->next;
 		}