Fix a bug where the default value for function argument could be an

array with array (!) keys.

Zend/zend_compile.c

@@ -3407,6 +3407,9 @@ void zend_do_add_static_array_element(znode *result, znode *offset, znode *expr)
 			case IS_DOUBLE:
 				zend_hash_index_update(Z_ARRVAL(result->u.constant), (long)Z_DVAL(offset->u.constant), &element, sizeof(zval *), NULL);
 				break;
+			case IS_CONSTANT_ARRAY:
+				zend_error(E_ERROR, "Illegal offset type");
+				break;
 		}
 	} else {
 		zend_hash_next_index_insert(Z_ARRVAL(result->u.constant), &element, sizeof(zval *), NULL);

Zend/zend_language_parser.y

@@ -611,8 +611,13 @@ expr_without_variable:
 	|	internal_functions_in_yacc { $$ = $1; }
 	|	T_INT_CAST expr 	{ zend_do_cast(&$$, &$2, IS_LONG TSRMLS_CC); }
 	|	T_DOUBLE_CAST expr 	{ zend_do_cast(&$$, &$2, IS_DOUBLE TSRMLS_CC); }
+<<<<<<< zend_language_parser.y
+	|	T_STRING_CAST expr	{ zend_do_cast(&$$, &$2, IS_STRING TSRMLS_CC); } 
+	|	T_UNICODE_CAST expr	{ zend_do_cast(&$$, &$2, IS_UNICODE TSRMLS_CC); } 
+=======
 	|	T_STRING_CAST expr	{ zend_do_cast(&$$, &$2, UG(unicode)?IS_UNICODE:IS_STRING TSRMLS_CC); }
 	|	T_UNICODE_CAST expr	{ zend_do_cast(&$$, &$2, IS_UNICODE TSRMLS_CC); }
+>>>>>>> 1.167
 	|	T_ARRAY_CAST expr 	{ zend_do_cast(&$$, &$2, IS_ARRAY TSRMLS_CC); }
 	|	T_OBJECT_CAST expr 	{ zend_do_cast(&$$, &$2, IS_OBJECT TSRMLS_CC); }
 	|	T_BOOL_CAST expr	{ zend_do_cast(&$$, &$2, IS_BOOL TSRMLS_CC); }