Fixed bug #79790

I haven't tracked down in detail where the interaction with
increment_function comes from, but the root problem here is failure
to handle the illegal offset type exception.

diff --git a/NEWS b/NEWS
index dd575f4477222819eb485c2ec145f92f4bde9486..faf1c1d5cec4ed5055d03fd77db668ebcd8f960d 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.0.0alpha3
 
+- Core:
+  . Fixed bug #79790 ("Illegal offset type" exception during AST evaluation
+    not handled properly). (Nikita)
 
 09 Jul 2020, PHP 8.0.0alpha2
 

diff --git a/Zend/tests/bug79790.phpt b/Zend/tests/bug79790.phpt
new file mode 100644 (file)
index 0000000..4fce252
--- /dev/null
+++ b/Zend/tests/bug79790.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #79790: "Illegal offset type" exception during AST evaluation not handled properly
+--FILE--
+<?php
+b();
+function b($a = array()[array ()]) {
+    ++$c[function () {}];
+}
+?>
+--EXPECTF--
+Fatal error: Uncaught TypeError: Illegal offset type in %s:%d
+Stack trace:
+#0 %s(%d): b()
+#1 {main}
+  thrown in %s on line %d

diff --git a/Zend/zend_ast.c b/Zend/zend_ast.c
index 53c3be0de944d896e941fcc55bd19c95be04a053..5ffaabfc689f64c1add685aee5c5f021403ec05f 100644 (file)
--- a/Zend/zend_ast.c
+++ b/Zend/zend_ast.c
@@ -750,6 +750,9 @@ ZEND_API int ZEND_FASTCALL zend_ast_evaluate(zval *result, zend_ast *ast, zend_c
 
                                zval_ptr_dtor_nogc(&op1);
                                zval_ptr_dtor_nogc(&op2);
+                               if (UNEXPECTED(EG(exception))) {
+                                       return FAILURE;
+                               }
                        }
                        break;
                default: