Fixed incorrect usage of QM_ASSIGN instruction

diff --git a/NEWS b/NEWS
index ae8780f26b18a8f4c91b5ec384ceae0db04bc6a1..63ee02113ee4505a9d16013b94510127169f68c3 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,9 @@ PHP                                                                        NEWS
 ?? ??? ????, PHP 7.4.0RC2
 
 - Core:
+  . Fixed incorrect usage of QM_ASSIGN instruction. It must not return IS_VAR.
+    As a side effect this allowed passign left hean list() "by reference",
+    instead of compile-time error. (Dmitry)
   . Fixed bug #78531 (Crash when using undefined variable as object). (Dmitry)
 
 - FFI:

diff --git a/Zend/tests/bug73663.phpt b/Zend/tests/bug73663.phpt
index 0c6373bc950936d1965c19d8691e106b211eaa98..06dd7f6700fe9084caa796392d67b3ee2b192425 100644 (file)
--- a/Zend/tests/bug73663.phpt
+++ b/Zend/tests/bug73663.phpt
@@ -20,12 +20,8 @@ var_dump($array);
 $array = [1];
 $func(list(&$val) = $array);
 var_dump($array);
-
-$array = [1];
-change(list($val) = $array);
-var_dump($array);
 ?>
---EXPECTF--
+--EXPECT--
 array(1) {
   [0]=>
   int(1)
@@ -74,9 +70,3 @@ array(10) {
   [9]=>
   int(10)
 }
-
-Notice: Only variables should be passed by reference in %s on line %d
-array(1) {
-  [0]=>
-  int(1)
-}

diff --git a/Zend/tests/bug73663_2.phpt b/Zend/tests/bug73663_2.phpt
new file mode 100644 (file)
index 0000000..660a4f8
--- /dev/null
+++ b/Zend/tests/bug73663_2.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #73663.2 ("Invalid opcode 65/16/8" occurs with a variable created with list())
+--FILE--
+<?php
+function change(&$ref) {
+       $ref = range(1, 10);
+       return;
+}
+
+$array = [1];
+change(list($val) = $array);
+var_dump($array);
+?>
+--EXPECTF--
+Fatal error: Only variables can be passed by reference in %s on line %d

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index e46c5b0d10788c873078749a36c88903fc35bf06..3fc35bedfd8c71e67a37f431590c2431637abda8 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -2761,7 +2761,7 @@ void zend_compile_assign(znode *result, zend_ast *ast) /* {{{ */
                                if (zend_try_compile_cv(&cv_node, expr_ast) == FAILURE) {
                                        zend_compile_simple_var_no_cv(&expr_node, expr_ast, BP_VAR_R, 0);
                                } else {
-                                       zend_emit_op(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
+                                       zend_emit_op_tmp(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
                                }
                        } else {
                                zend_compile_expr(&expr_node, expr_ast);
@@ -2801,7 +2801,7 @@ void zend_compile_assign(znode *result, zend_ast *ast) /* {{{ */
                                        if (zend_try_compile_cv(&cv_node, expr_ast) == FAILURE) {
                                                zend_compile_simple_var_no_cv(&expr_node, expr_ast, BP_VAR_R, 0);
                                        } else {
-                                               zend_emit_op(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
+                                               zend_emit_op_tmp(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
                                        }
                                } else {
                                        zend_compile_expr(&expr_node, expr_ast);