From: Nikita Popov <nikita.ppv@gmail.com>
Date: Tue, 7 Jul 2020 14:00:50 +0000 (+0200)
Subject: Fixed bug #79791
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=beb002a8670025b683cbe9f7011a9127304a307e;p=php

Fixed bug #79791

First throw the undefined variable warning, and then set the
variable to null. Otherwise we're not guaranteed that it's
actually null afterwards.
---

diff --git a/NEWS b/NEWS
index faf1c1d5ce..a93706e135 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,8 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #79790 ("Illegal offset type" exception during AST evaluation
     not handled properly). (Nikita)
+  . Fixed bug #79791 (Assertion failure when unsetting variable during binary
+    op). (Nikita)
 
 09 Jul 2020, PHP 8.0.0alpha2
 
diff --git a/Zend/tests/bug79791.phpt b/Zend/tests/bug79791.phpt
new file mode 100644
index 0000000000..f8b80a51d9
--- /dev/null
+++ b/Zend/tests/bug79791.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #79791: Assertion failure when unsetting variable during binary op
+--FILE--
+<?php
+set_error_handler(function() {
+    unset($GLOBALS['c']);
+});
+$c -= 1;
+var_dump($c);
+?>
+--EXPECT--
+int(-1)
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 69a9afecc1..fb8aca9c3a 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -367,8 +367,8 @@ static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_RW(uint32_t var EXECUTE_
 	zval *ret = EX_VAR(var);
 
 	if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
-		ZVAL_NULL(ret);
 		zval_undefined_cv(var EXECUTE_DATA_CC);
+		ZVAL_NULL(ret);
 		return ret;
 	}
 	return ret;