Fix use of UNDEF instead of NULL in read_dimension

Zend/tests/ArrayAccess_indirect_append.phpt

@@ -0,0 +1,43 @@
+--TEST--
+Using indirect append on ArrayAccess object
+--FILE--
+<?php
+
+class AA implements ArrayAccess {
+    private $data = [];
+    public function &offsetGet($name) {
+        if (null === $name) {
+            return $this->data[];
+        } else {
+            return $this->data[$name];
+        }
+    }
+    public function offsetSet($name, $value) {
+        $this->data[$name] = $value;
+    }
+    public function offsetUnset($name) {}
+    public function offsetExists($name) {}
+}
+
+$aa = new AA;
+$aa[3] = 1;
+$aa[][][0] = 2;
+var_dump($aa);
+
+?>
+--EXPECT--
+object(AA)#1 (1) {
+  ["data":"AA":private]=>
+  array(2) {
+    [3]=>
+    int(1)
+    [4]=>
+    array(1) {
+      [0]=>
+      array(1) {
+        [0]=>
+        int(2)
+      }
+    }
+  }
+}

Zend/tests/bug69955.phpt

@@ -27,8 +27,6 @@ $c10 = new C10;
 var_dump($c10[] += 5);
 --EXPECTF--
 Inside C10::offsetGet
-
-Notice: Undefined variable: offset in %sbug69955.php on line 10
 NULL
 
 Inside C10::offsetSet

Zend/zend_object_handlers.c

@@ -712,7 +712,7 @@ zval *zend_std_read_dimension(zval *object, zval *offset, int type, zval *rv) /*
 	if (EXPECTED(instanceof_function_ex(ce, zend_ce_arrayaccess, 1) != 0)) {
 		if(offset == NULL) {
 			/* [] construct */
-			ZVAL_UNDEF(&tmp);
+			ZVAL_NULL(&tmp);
 			offset = &tmp;
 		} else {
 			SEPARATE_ARG_IF_REF(offset);