Merge branch 'PHP-8.1' into PHP-8.2

arnaud-lb · arnaud-lb · commit c2e77f9c0fe3 · 2023-01-20T16:52:52.000+01:00
* PHP-8.1: [ci skip] NEWS Fix GH-10248: Assertion `!(zval_get_type(&(*(property))) == 10)' failed.
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
@@ -2130,6 +2130,7 @@ ZEND_VM_C_LABEL(fetch_obj_r_fast_copy):
 #if ZEND_DEBUG
 		if (!EG(exception) && prop_info && prop_info != ZEND_WRONG_PROPERTY_INFO
 				&& ZEND_TYPE_IS_SET(prop_info->type)) {
+			ZVAL_OPT_DEREF(retval);
 			zend_verify_property_type(prop_info, retval, /* strict */ true);
 		}
 #endif
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
diff --git a/ext/spl/tests/gh10248.phpt b/ext/spl/tests/gh10248.phpt
@@ -0,0 +1,18 @@
+--TEST--
+GH-10248 (Assertion `!(zval_get_type(&(*(property))) == 10)' failed.)
+--FILE--
+<?php
+
+class a extends ArrayIterator
+{
+    public ?int $property;
+}
+$a = new a();
+$a->property = &$b;
+$a->property;
+
+echo "Done\n";
+
+?>
+--EXPECT--
+Done

Original file line number	Diff line number	Diff line change
`@@ -2130,6 +2130,7 @@ ZEND_VM_C_LABEL(fetch_obj_r_fast_copy):`
`2130`	`2130`	`#if ZEND_DEBUG`
`2131`	`2131`	`if (!EG(exception) && prop_info && prop_info != ZEND_WRONG_PROPERTY_INFO`
`2132`	`2132`	`&& ZEND_TYPE_IS_SET(prop_info->type)) {`
	`2133`	`+ ZVAL_OPT_DEREF(retval);`
`2133`	`2134`	`zend_verify_property_type(prop_info, retval, /* strict */ true);`
`2134`	`2135`	`}`
`2135`	`2136`	`#endif`