From: Nikita Popov <nikita.ppv@gmail.com>
Date: Mon, 25 Jun 2018 12:23:06 +0000 (+0200)
Subject: Use COPY_DEREF for DIM_IS and LIST_R as well
X-Git-Tag: php-7.3.0alpha3~73
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=490a49d0bb569e4d6643dc93138cfe56002a1322;p=php

Use COPY_DEREF for DIM_IS and LIST_R as well

Also add an upgrading note for the behavior change, not that we
expect anyone to be affected...
---

diff --git a/UPGRADING b/UPGRADING
index 9350f2899c..6b5b267a07 100644
--- a/UPGRADING
+++ b/UPGRADING
@@ -44,6 +44,18 @@ Core:
     the following "FOO;" will cause a syntax error. This issue can always be
     resolved by choosing an ending label that does not occur within the contents
     of the string.
+  . References returned by array and property accesses are now unwrapped as
+    part of the access. This means that it is no longer possible to modify the
+    reference between the access and the use of the accessed value:
+
+        $arr = [1];
+        $ref =& $arr[0];
+        var_dump($arr[0] + ($arr[0] = 2));
+        // Previously: int(4), Now: int(3)
+
+    This makes the behavior of references and non-references consistent. Please
+    note that reading and writing a value inside a single expression remains
+    undefined behavior and may change again in the future.
 
 BCMath:
   . All warnings thrown by BCMath functions are now using PHP's error handling.
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 86590383b0..c64053da74 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1953,7 +1953,7 @@ static zend_always_inline void zend_fetch_dimension_address_read(zval *result, z
 		if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
 try_array:
 			retval = zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), dim, dim_type, type EXECUTE_DATA_CC);
-			ZVAL_COPY(result, retval);
+			ZVAL_COPY_DEREF(result, retval);
 			return;
 		} else if (EXPECTED(Z_TYPE_P(container) == IS_REFERENCE)) {
 			container = Z_REFVAL_P(container);
diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index 2e37483991..b49fa61e31 100644
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -2060,7 +2060,7 @@ uint32_t zend_array_element_type(zend_op *opline, uint32_t t1)
 			}
 			if (t1 & MAY_BE_ARRAY_OF_REF) {
 				if (opline->opcode == ZEND_FETCH_DIM_R) {
-				/* can't be REF  because of ZVAL_COPY_DEREF() usage */
+					/* can't be REF  because of ZVAL_COPY_DEREF() usage */
 					tmp |= MAY_BE_RC1 | MAY_BE_RCN;
 				} else {
 					tmp |= MAY_BE_REF | MAY_BE_RC1 | MAY_BE_RCN;