-
Notifications
You must be signed in to change notification settings - Fork 8k
Open
Labels
Description
Description
The following code:
<?php
class C {
public string $a = '';
public $b;
function __toString() {
global $c; // turns rvalue into a ref
return '';
}
}
$c = new C;
$c->b = &$c->a;
$c->b = $c;Resulted in this output:
zend_execute.c:4093: i_zval_ptr_dtor_noref: Assertion `zval_get_type(&(*(zval_ptr))) != 10' failed.
Root cause is that we call zend_assign_to_variable_ex() / zend_assign_to_typed_ref_ex() with value_type=IS_TMP_VAR, when value may be a CV slot here:
php-src/Zend/zend_object_handlers.c
Lines 875 to 876 in 02c67b4
| variable_ptr = zend_assign_to_variable_ex( | |
| variable_ptr, value, IS_TMP_VAR, property_uses_strict_types(), &garbage); |
Therefore the slot may have been modified when reaching this call:
Line 3665 in 02c67b4
| i_zval_ptr_dtor_noref(orig_value); |
With the code above, the assertion fails because orig_value is now a ref.
PHP Version
PHP 8.3
Operating System
No response