ID: 33169 User updated by: tomas_matousek at hotmail dot com Reported By: tomas_matousek at hotmail dot com Status: Open Bug Type: Zend Engine 2 problem Operating System: WinXP PHP Version: 5.0.4 New Comment:
I'm sorry for mystifying with: $obj[][] = 1; it doesn't crash yet reports strange error even if I return an array by reference from offsetGet(): Fatal error: Objects used as arrays in post/pre increment/decrement must return values by reference in C:\Web\$PhpTests\y.php on line 32. this also works fine: $obj[$obj[1]] = 1; but others don't $obj[$obj[1]] = 1; Previous Comments: ------------------------------------------------------------------------ [2005-05-28 10:09:46] tomas_matousek at hotmail dot com Description: ------------ I looks like you have never do in-depth testing with ArrayAccess. I you did you must realize many things are wrong there. It took me less then 5 minutes to kill PHP several times using this naively implemented feature. Reproduce code: --------------- class ArrayClass implements ArrayAccess { public $a = array(); function offsetExists($index) { return array_key_exists($index, $this->a); } function offsetGet($index) { return $this->a[$index]; } function offsetSet($index, $newval) { return $this->a[$index] = $newval; } function offsetUnset($index) { unset($this->a[$index]); } } Expected result: ---------------- It's unclear for me what should I expect. Definitly not the crashes. Can anyone explain, what should I expect from e.g. $obj[1][2][3] = 1; ? And what should $a =& $obj[1][2][3]; do? Actual result: -------------- $obj[array()] = 1; // crash $obj[][] = 1; // crash $x =& $obj[1] // crash $obj[$obj[1]] = 1; // if offsetGet() returns null, the offsetSet() is called then $obj[1]++; // doesn't work at all even if both offsetGet and offsetSet are modified to return by reference ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=33169&edit=1