From: Nikita Popov <nikita.ppv@gmail.com>
Date: Tue, 7 Jul 2020 08:56:55 +0000 (+0200)
Subject: Fixed bug #79790
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=eaf6303a74729c2637154fc09ee44446864cb5f7;p=php

Fixed bug #79790

I haven't tracked down in detail where the interaction with
increment_function comes from, but the root problem here is failure
to handle the illegal offset type exception.
---

diff --git a/NEWS b/NEWS
index dd575f4477..faf1c1d5ce 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.0.0alpha3
 
+- Core:
+  . Fixed bug #79790 ("Illegal offset type" exception during AST evaluation
+    not handled properly). (Nikita)
 
 09 Jul 2020, PHP 8.0.0alpha2
 
diff --git a/Zend/tests/bug79790.phpt b/Zend/tests/bug79790.phpt
new file mode 100644
index 0000000000..4fce25291b
--- /dev/null
+++ b/Zend/tests/bug79790.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #79790: "Illegal offset type" exception during AST evaluation not handled properly
+--FILE--
+<?php
+b();
+function b($a = array()[array ()]) {
+    ++$c[function () {}];
+}
+?>
+--EXPECTF--
+Fatal error: Uncaught TypeError: Illegal offset type in %s:%d
+Stack trace:
+#0 %s(%d): b()
+#1 {main}
+  thrown in %s on line %d
diff --git a/Zend/zend_ast.c b/Zend/zend_ast.c
index 53c3be0de9..5ffaabfc68 100644
--- a/Zend/zend_ast.c
+++ b/Zend/zend_ast.c
@@ -750,6 +750,9 @@ ZEND_API int ZEND_FASTCALL zend_ast_evaluate(zval *result, zend_ast *ast, zend_c
 
 				zval_ptr_dtor_nogc(&op1);
 				zval_ptr_dtor_nogc(&op2);
+				if (UNEXPECTED(EG(exception))) {
+					return FAILURE;
+				}
 			}
 			break;
 		default: