From 8e09ecc237ef8ab2953515f53b6e782b3240af4f Mon Sep 17 00:00:00 2001
From: Sara Golemon <saramg@fb.com>
Date: Tue, 24 Jul 2012 05:22:13 -0700
Subject: [PATCH] Fix bug where HphpArray::lvalPtr returned pointer to wrong
 data

---
 src/runtime/base/array/hphp_array.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/runtime/base/array/hphp_array.cpp b/src/runtime/base/array/hphp_array.cpp
index 54bbeb2cad5f9..29dce0bd7649e 100644
--- a/src/runtime/base/array/hphp_array.cpp
+++ b/src/runtime/base/array/hphp_array.cpp
@@ -1294,7 +1294,7 @@ ArrayData *HphpArray::lvalPtr(CStrRef k, Variant*& ret, bool copy,
   } else {
     ssize_t /*ElmInd*/ pos = t->find(key->data(), key->size(), prehash);
     if (pos != (ssize_t)ElmIndEmpty) {
-      Elm* e = &m_data[pos];
+      Elm* e = &t->m_data[pos];
       ret = &tvAsVariant(&e->data);
     } else {
       ret = NULL;
@@ -1316,7 +1316,7 @@ ArrayData *HphpArray::lvalPtr(int64 k, Variant*& ret, bool copy,
   } else {
     ElmInd pos = t->find(k);
     if (pos != ElmIndEmpty) {
-      Elm* e = &m_data[pos];
+      Elm* e = &t->m_data[pos];
       ret = &tvAsVariant(&e->data);
     } else {
       ret = NULL;