Use COPY_DEREF for DIM_IS and LIST_R as well

Also add an upgrading note for the behavior change, not that we
expect anyone to be affected...

diff --git a/UPGRADING b/UPGRADING
index 9350f2899cd163195530e8cb7858c4e509fecb9c..6b5b267a07ea163bb103633d1e7b650afc741d0e 100644 (file)
--- a/UPGRADING
+++ b/UPGRADING
@@ -44,6 +44,18 @@ Core:
     the following "FOO;" will cause a syntax error. This issue can always be
     resolved by choosing an ending label that does not occur within the contents
     of the string.
+  . References returned by array and property accesses are now unwrapped as
+    part of the access. This means that it is no longer possible to modify the
+    reference between the access and the use of the accessed value:
+
+        $arr = [1];
+        $ref =& $arr[0];
+        var_dump($arr[0] + ($arr[0] = 2));
+        // Previously: int(4), Now: int(3)
+
+    This makes the behavior of references and non-references consistent. Please
+    note that reading and writing a value inside a single expression remains
+    undefined behavior and may change again in the future.
 
 BCMath:
   . All warnings thrown by BCMath functions are now using PHP's error handling.

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 86590383b021135cb33f7e5fb968495f2fb88b80..c64053da74e94c005078cd8f65349b580cdc7e07 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1953,7 +1953,7 @@ static zend_always_inline void zend_fetch_dimension_address_read(zval *result, z
                if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
 try_array:
                        retval = zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), dim, dim_type, type EXECUTE_DATA_CC);
-                       ZVAL_COPY(result, retval);
+                       ZVAL_COPY_DEREF(result, retval);
                        return;
                } else if (EXPECTED(Z_TYPE_P(container) == IS_REFERENCE)) {
                        container = Z_REFVAL_P(container);

diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index 2e374839918a0b660a73f039183c23bdf778a403..b49fa61e31cc8c27abbc2f3143c62b20b73ca9c1 100644 (file)
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -2060,7 +2060,7 @@ uint32_t zend_array_element_type(zend_op *opline, uint32_t t1)
                        }
                        if (t1 & MAY_BE_ARRAY_OF_REF) {
                                if (opline->opcode == ZEND_FETCH_DIM_R) {
-                               /* can't be REF  because of ZVAL_COPY_DEREF() usage */
+                                       /* can't be REF  because of ZVAL_COPY_DEREF() usage */
                                        tmp |= MAY_BE_RC1 | MAY_BE_RCN;
                                } else {
                                        tmp |= MAY_BE_REF | MAY_BE_RC1 | MAY_BE_RCN;