The problem still exists on the latest snapshot (Jul 13, 2004 12:30 GMT) and seems to be os-independent (I've tried on FreeBSD 4.9 and Windows XP).

<?php

class foo implements ArrayAccess {
  function offsetSet($k,$v){}
  function offsetGet($k){return $this;}
  function offsetExists($k){return true;}
  function offsetUnset($k){}
  function __set($k, $v){}
  function __get($k){return $this;}
}

$bar = new foo;
$bar[]->blabla = 1;

?>


Program received signal SIGSEGV, Segmentation fault.
0x821272b in zend_call_function (fci=0xbfbfe26c, fci_cache=0xbfbfe24c)
    at /usr/ports/lang/php5/work/php-5.0.0RC3/Zend/zend_execute_API.c:752
752                             (*fci->params[i])->refcount++;
(gdb) bt
#0  0x821272b in zend_call_function (fci=0xbfbfe26c, fci_cache=0xbfbfe24c)
    at /usr/ports/lang/php5/work/php-5.0.0RC3/Zend/zend_execute_API.c:752
#1  0x822d63e in zend_call_method (object_pp=0xbfbfe2e8, obj_ce=0x84f8824, fn_proxy=0x0,
    function_name=0x83f63ff "offsetget", function_name_len=9, retval_ptr_ptr=0xbfbfe2dc, param_count=1, arg1=0x0, arg2=0x0)
    at /usr/ports/lang/php5/work/php-5.0.0RC3/Zend/zend_interfaces.c:79
#2  0x8230bea in zend_std_read_dimension (object=0x85065e4, offset=0x0, type=1)
    at /usr/ports/lang/php5/work/php-5.0.0RC3/Zend/zend_object_handlers.c:384
#3  0x823d79c in zend_fetch_dimension_address (result=0x850e3b8, op1=0x850e3cc, op2=0x850e3e0, Ts=0x8510624, type=1)
    at /usr/ports/lang/php5/work/php-5.0.0RC3/Zend/zend_execute.c:999
#4  0x825802b in zend_fetch_dim_w_handler (execute_data=0xbfbfe404, opline=0x850e3b4, op_array=0x8505124)
    at /usr/ports/lang/php5/work/php-5.0.0RC3/Zend/zend_execute.c:2063
#5  0x823fbcf in execute (op_array=0x8505124) at /usr/ports/lang/php5/work/php-5.0.0RC3/Zend/zend_execute.c:1391
#6  0x821e32e in zend_execute_scripts (type=8, retval=0x0, file_count=3)
    at /usr/ports/lang/php5/work/php-5.0.0RC3/Zend/zend.c:1061
#7  0x81e3ba5 in php_execute_script (primary_file=0xbfbffac0) at /usr/ports/lang/php5/work/php-5.0.0RC3/main/main.c:1627
#8  0x82688ce in main (argc=3, argv=0xbfbffb3c) at /usr/ports/lang/php5/work/php-5.0.0RC3/sapi/cli/php_cli.c:943

p.s. don't take to notice that the name of directory is php5.0.0RC3 - it's the latest snap really. :)

Both scripts segv.

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.