Fix incorrect assertion in property type variance check

Only one of the status has to be UNRESOLVED, the other could also
be SUCCESS.

Fixes oss-fuzz #19108 and oss-fuzz #19111.

diff --git a/Zend/tests/type_declarations/union_types/variance/invalid_004.phpt b/Zend/tests/type_declarations/union_types/variance/invalid_004.phpt
new file mode 100644 (file)
index 0000000..db16fec
--- /dev/null
+++ b/Zend/tests/type_declarations/union_types/variance/invalid_004.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Invalid property inheritance where one direction is valid and the other unresolved
+--FILE--
+<?php
+class A {
+    public X|B $prop;
+}
+class B extends A {
+    public B $prop;
+} 
+?>
+--EXPECTF--
+Fatal error: Type of B::$prop must be X|B (as in class A) in %s on line %d

diff --git a/Zend/zend_inheritance.c b/Zend/zend_inheritance.c
index 9b8a47f365ba5542dfd61f27b4b4935aa5b082b9..1a27bbdfb6cedf49ef98ab64784f58bede4a94d8 100644 (file)
--- a/Zend/zend_inheritance.c
+++ b/Zend/zend_inheritance.c
@@ -966,7 +966,7 @@ inheritance_status property_types_compatible(
        if (status1 == INHERITANCE_ERROR || status2 == INHERITANCE_ERROR) {
                return INHERITANCE_ERROR;
        }
-       ZEND_ASSERT(status1 == INHERITANCE_UNRESOLVED && status2 == INHERITANCE_UNRESOLVED);
+       ZEND_ASSERT(status1 == INHERITANCE_UNRESOLVED || status2 == INHERITANCE_UNRESOLVED);
        return INHERITANCE_UNRESOLVED;
 }