From: Nikita Popov <nikita.ppv@gmail.com>
Date: Tue, 7 Jul 2020 12:24:39 +0000 (+0200)
Subject: Merge branch 'PHP-7.4'
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f497b699448ba16c63903c75d4eee9682ff0099a;p=php

Merge branch 'PHP-7.4'

* PHP-7.4:
  Fixed bug #79784
---

f497b699448ba16c63903c75d4eee9682ff0099a
diff --cc Zend/zend_execute.c
index f49b005a14,5aed92ff45..bd4ce8fa7e
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@@ -2010,18 -2060,32 +2010,31 @@@ static ZEND_COLD void zend_binary_assig
  			zend_check_string_offset(dim, BP_VAR_RW EXECUTE_DATA_CC);
  			zend_wrong_string_offset(EXECUTE_DATA_C);
  		}
 -	} else if (EXPECTED(!Z_ISERROR_P(container))) {
 +	} else {
  		zend_use_scalar_as_array();
  	}
 -	get_op_data_zval_ptr_r((opline+1)->op1_type, (opline+1)->op1, &free_op_data1);
 -	FREE_OP(free_op_data1);
 +	FREE_OP((opline+1)->op1_type, (opline+1)->op1.var);
  }
  
- static zend_never_inline zend_uchar slow_index_convert(const zval *dim, zend_value *value EXECUTE_DATA_DC)
+ static zend_never_inline zend_uchar slow_index_convert(HashTable *ht, const zval *dim, zend_value *value EXECUTE_DATA_DC)
  {
  	switch (Z_TYPE_P(dim)) {
- 		case IS_UNDEF:
+ 		case IS_UNDEF: {
+ 			/* The array may be destroyed while throwing the notice.
+ 			 * Temporarily increase the refcount to detect this situation. */
+ 			if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
+ 				GC_ADDREF(ht);
+ 			}
  			ZVAL_UNDEFINED_OP2();
+ 			if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
+ 				zend_array_destroy(ht);
+ 				return IS_NULL;
+ 			}
+ 			if (EG(exception)) {
+ 				return IS_NULL;
+ 			}
  			/* break missing intentionally */
+ 		}
  		case IS_NULL:
  			value->str = ZSTR_EMPTY_ALLOC();
  			return IS_STRING;