Fixed bug #34358 (Fatal error: Cannot re-assign $this)

NEWS

@@ -58,6 +58,7 @@ PHP                                                                        NEWS
 - Fixed bug #34450 (Segfault when calling mysqli_close() in destructor). (Tony)
 - Fixed bug #34449 (ext/soap: XSD_ANYXML functionality not exposed). (Dmitry)
 - Fixed bug #34420 (Possible crash inside curl_multi_remove_handle()). (Ilia)
+- Fixed bug #34358 (Fatal error: Cannot re-assign $this). (Dmitry)
 - Fixed bug #34331 (php crashes when variables_order is empty). (Ilia)
 - Fixed bug #34321 (Possible crash in filter code). (Ilia)
 - Fixed bug #34311 (unserialize() crashes with chars above 191 dec). (Nuno)

Zend/tests/bug34358.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #34358 (Fatal error: Cannot re-assign $this(again))
+--FILE--
+<?php
+class foo {
+  function bar() {
+    $ref = &$this;
+  }
+}
+$x = new foo();
+$x->bar();
+echo "ok\n";
+?>
+--EXPECT--
+ok

Zend/zend_compile.c

@@ -567,7 +567,8 @@ void zend_do_assign(znode *result, znode *variable, znode *value TSRMLS_DC)
 			*result = last_op->result;
 			return;
 		} else {
-			if (opline_is_fetch_this(last_op TSRMLS_CC)) {
+			if (variable->op_type == IS_VAR &&
+			    opline_is_fetch_this(last_op TSRMLS_CC)) {
 				zend_error(E_COMPILE_ERROR, "Cannot re-assign $this");
 			}
 		}
@@ -597,7 +598,8 @@ void zend_do_assign_ref(znode *result, znode *lvar, znode *rvar TSRMLS_DC)
 	if (last_op_number > 0) {
 		zend_op *last_op = &CG(active_op_array)->opcodes[last_op_number-1];
 
-		if (opline_is_fetch_this(last_op TSRMLS_CC)) {
+		if (lvar->op_type == IS_VAR &&
+		    opline_is_fetch_this(last_op TSRMLS_CC)) {
 			zend_error(E_COMPILE_ERROR, "Cannot re-assign $this");
 		}
 	}