Fixed bug #79791

First throw the undefined variable warning, and then set the
variable to null. Otherwise we're not guaranteed that it's
actually null afterwards.

diff --git a/NEWS b/NEWS
index faf1c1d5cec4ed5055d03fd77db668ebcd8f960d..a93706e13589fcf0ef85e575d825c9c3613396ed 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,8 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #79790 ("Illegal offset type" exception during AST evaluation
     not handled properly). (Nikita)
+  . Fixed bug #79791 (Assertion failure when unsetting variable during binary
+    op). (Nikita)
 
 09 Jul 2020, PHP 8.0.0alpha2
 

diff --git a/Zend/tests/bug79791.phpt b/Zend/tests/bug79791.phpt
new file mode 100644 (file)
index 0000000..f8b80a5
--- /dev/null
+++ b/Zend/tests/bug79791.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #79791: Assertion failure when unsetting variable during binary op
+--FILE--
+<?php
+set_error_handler(function() {
+    unset($GLOBALS['c']);
+});
+$c -= 1;
+var_dump($c);
+?>
+--EXPECT--
+int(-1)

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 69a9afecc17ac062198bc6a973a7f053e96ded9c..fb8aca9c3ae216df098d9901c0214304dde1b875 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -367,8 +367,8 @@ static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_RW(uint32_t var EXECUTE_
        zval *ret = EX_VAR(var);
 
        if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
-               ZVAL_NULL(ret);
                zval_undefined_cv(var EXECUTE_DATA_CC);
+               ZVAL_NULL(ret);
                return ret;
        }
        return ret;