diff --git a/Zend/tests/ex_func_null_during_property_write.phpt b/Zend/tests/ex_func_null_during_property_write.phpt new file mode 100644 index 00000000000..6a253f760e0 --- /dev/null +++ b/Zend/tests/ex_func_null_during_property_write.phpt @@ -0,0 +1,25 @@ +--TEST-- +EX(func) can be null during write_property in an edge case +--FILE-- + +--EXPECTF-- +Fatal error: Uncaught Error: Object of class a could not be converted to string in %s:%d +Stack trace: +#0 %s(%d): a->__destruct() +#1 {main} + +Next Exception in %s:%d +Stack trace: +#0 %s(%d): a->__destruct() +#1 {main} + thrown in %s on line %d diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c index 063a2747224..a4ee0feda8a 100644 --- a/Zend/zend_object_handlers.c +++ b/Zend/zend_object_handlers.c @@ -691,6 +691,13 @@ exit: } /* }}} */ +static zend_always_inline zend_bool property_uses_strict_types() { + zend_execute_data *execute_data = EG(current_execute_data); + return execute_data + && execute_data->func + && ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data)); +} + ZEND_API zval *zend_std_write_property(zend_object *zobj, zend_string *name, zval *value, void **cache_slot) /* {{{ */ { zval *variable_ptr, tmp; @@ -707,7 +714,7 @@ ZEND_API zval *zend_std_write_property(zend_object *zobj, zend_string *name, zva if (UNEXPECTED(prop_info)) { ZVAL_COPY_VALUE(&tmp, value); - if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, EG(current_execute_data) && ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) { + if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, property_uses_strict_types()))) { Z_TRY_DELREF_P(value); variable_ptr = &EG(error_zval); goto exit; @@ -716,7 +723,7 @@ ZEND_API zval *zend_std_write_property(zend_object *zobj, zend_string *name, zva } found: - zend_assign_to_variable(variable_ptr, value, IS_TMP_VAR, EG(current_execute_data) && ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))); + zend_assign_to_variable(variable_ptr, value, IS_TMP_VAR, property_uses_strict_types()); goto exit; } if (Z_PROP_FLAG_P(variable_ptr) == IS_PROP_UNINIT) { @@ -772,7 +779,7 @@ write_std_property: if (UNEXPECTED(prop_info)) { ZVAL_COPY_VALUE(&tmp, value); - if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) { + if (UNEXPECTED(!zend_verify_property_type(prop_info, &tmp, property_uses_strict_types()))) { zval_ptr_dtor(value); goto exit; }