Error on by-ref assign to overloaded prop returning ref

This error was already thrown if __get() was used -- however not
if it returned by reference. This is incorrect, because the
reference return makes no difference to a by-reference assignment,
which has reference-breaking semantics. The result was that the
assignment was accepted silently, even though it didn't do anything
(not even the value was assigned, let alone the reference).

diff --git a/Zend/tests/assign_ref_to_overloaded_prop.phpt b/Zend/tests/assign_ref_to_overloaded_prop.phpt
new file mode 100644 (file)
index 0000000..e961b8b
--- /dev/null
+++ b/Zend/tests/assign_ref_to_overloaded_prop.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Cannot assign by reference to overloaded object, even if __get() returns by-ref
+--FILE--
+<?php
+
+class Test {
+    private $x;
+    public function &__get($name) {
+        return $this->x;
+    }
+}
+
+$test = new Test;
+$y = 5;
+$test->x =& $y;
+var_dump($test->x);
+
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Cannot assign by reference to overloaded object in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 468da331211083d1f540eeac923938c963d3e46a..5e2fd5b316e706dc337cd1c72736bf7a57b23a15 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2325,7 +2325,6 @@ ZEND_VM_HANDLER(39, ZEND_ASSIGN_REF, VAR|CV, VAR|CV, SRC)
 
        if (OP1_TYPE == IS_VAR &&
            UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT) &&
-           UNEXPECTED(!Z_ISREF_P(EX_VAR(opline->op1.var))) &&
            UNEXPECTED(!Z_ISERROR_P(EX_VAR(opline->op1.var)))) {
 
                zend_throw_error(NULL, "Cannot assign by reference to overloaded object");

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 55d2ac063f46f356cef8c8d379355a5999d64625..3241578d1fb260be1e1f329251d48633797f6125 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -26374,7 +26374,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLE
 
        if (IS_VAR == IS_VAR &&
            UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT) &&
-           UNEXPECTED(!Z_ISREF_P(EX_VAR(opline->op1.var))) &&
            UNEXPECTED(!Z_ISERROR_P(EX_VAR(opline->op1.var)))) {
 
                zend_throw_error(NULL, "Cannot assign by reference to overloaded object");
@@ -29428,7 +29427,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER
 
        if (IS_VAR == IS_VAR &&
            UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT) &&
-           UNEXPECTED(!Z_ISREF_P(EX_VAR(opline->op1.var))) &&
            UNEXPECTED(!Z_ISERROR_P(EX_VAR(opline->op1.var)))) {
 
                zend_throw_error(NULL, "Cannot assign by reference to overloaded object");
@@ -45059,7 +45057,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER
 
        if (IS_CV == IS_VAR &&
            UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT) &&
-           UNEXPECTED(!Z_ISREF_P(EX_VAR(opline->op1.var))) &&
            UNEXPECTED(!Z_ISERROR_P(EX_VAR(opline->op1.var)))) {
 
                zend_throw_error(NULL, "Cannot assign by reference to overloaded object");
@@ -49572,7 +49569,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(
 
        if (IS_CV == IS_VAR &&
            UNEXPECTED(Z_TYPE_P(EX_VAR(opline->op1.var)) != IS_INDIRECT) &&
-           UNEXPECTED(!Z_ISREF_P(EX_VAR(opline->op1.var))) &&
            UNEXPECTED(!Z_ISERROR_P(EX_VAR(opline->op1.var)))) {
 
                zend_throw_error(NULL, "Cannot assign by reference to overloaded object");