From ede92a86f2ce1bd5f3961767aa1e291a3265f04b Mon Sep 17 00:00:00 2001
From: Tobias Bachert <git@b-privat.de>
Date: Fri, 15 Jul 2022 13:00:48 +0200
Subject: [PATCH 1/2] Fix `WeakMap` object reference offset causing `TypeError`
 (#8995)

---
 .../weakrefs/weakmap_object_reference.phpt    | 32 +++++++++++++++++++
 Zend/zend_weakrefs.c                          |  4 +++
 2 files changed, 36 insertions(+)
 create mode 100644 Zend/tests/weakrefs/weakmap_object_reference.phpt

diff --git a/Zend/tests/weakrefs/weakmap_object_reference.phpt b/Zend/tests/weakrefs/weakmap_object_reference.phpt
new file mode 100644
index 00000000000..b291092fdb7
--- /dev/null
+++ b/Zend/tests/weakrefs/weakmap_object_reference.phpt
@@ -0,0 +1,32 @@
+--TEST--
+WeakMap object reference offset
+--FILE--
+<?php
+
+$map = new WeakMap;
+$obj = new stdClass;
+$obj2 = &$obj;
+
+$map[$obj] = 1;
+var_dump(count($map));
+var_dump($map);
+var_dump(isset($map[$obj]));
+var_dump(!empty($map[$obj]));
+var_dump($map[$obj]);
+
+?>
+--EXPECT--
+int(1)
+object(WeakMap)#1 (1) {
+  [0]=>
+  array(2) {
+    ["key"]=>
+    object(stdClass)#2 (0) {
+    }
+    ["value"]=>
+    int(1)
+  }
+}
+bool(true)
+bool(true)
+int(1)
diff --git a/Zend/zend_weakrefs.c b/Zend/zend_weakrefs.c
index 1e1efda9239..548d530cdb2 100644
--- a/Zend/zend_weakrefs.c
+++ b/Zend/zend_weakrefs.c
@@ -310,6 +310,7 @@ static zval *zend_weakmap_read_dimension(zend_object *object, zval *offset, int
 		return NULL;
 	}
 
+	ZVAL_DEREF(offset);
 	if (Z_TYPE_P(offset) != IS_OBJECT) {
 		zend_type_error("WeakMap key must be an object");
 		return NULL;
@@ -340,6 +341,7 @@ static void zend_weakmap_write_dimension(zend_object *object, zval *offset, zval
 		return;
 	}
 
+	ZVAL_DEREF(offset);
 	if (Z_TYPE_P(offset) != IS_OBJECT) {
 		zend_type_error("WeakMap key must be an object");
 		return;
@@ -367,6 +369,7 @@ static void zend_weakmap_write_dimension(zend_object *object, zval *offset, zval
 /* int return and check_empty due to Object Handler API */
 static int zend_weakmap_has_dimension(zend_object *object, zval *offset, int check_empty)
 {
+	ZVAL_DEREF(offset);
 	if (Z_TYPE_P(offset) != IS_OBJECT) {
 		zend_type_error("WeakMap key must be an object");
 		return 0;
@@ -386,6 +389,7 @@ static int zend_weakmap_has_dimension(zend_object *object, zval *offset, int che
 
 static void zend_weakmap_unset_dimension(zend_object *object, zval *offset)
 {
+	ZVAL_DEREF(offset);
 	if (Z_TYPE_P(offset) != IS_OBJECT) {
 		zend_type_error("WeakMap key must be an object");
 		return;

From 20473374fa3cc33ec53a1a66d1fef11d4776a064 Mon Sep 17 00:00:00 2001
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
Date: Fri, 15 Jul 2022 13:14:17 +0200
Subject: [PATCH 2/2] [ci skip] NEWS

---
 NEWS | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/NEWS b/NEWS
index 682404e4060..fa89c45c695 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,8 @@ PHP                                                                        NEWS
 
 - Core:
   . Fixed bug GH-8923 (error_log on Windows can hold the file write lock). (cmb)
+  . Fixed bug GH-8995 (WeakMap object reference offset causing TypeError).
+    (Tobias Bachert)
 
 - Date:
   . Fixed bug #80047 (DatePeriod doesn't warn with custom DateTimeImmutable).