Fixed bug #79791

First throw the undefined variable warning, and then set the variable to null. Otherwise we're not guaranteed that it's actually null afterwards.
php · Jul 7, 2020 · beb002a · beb002a
1 parent 6259eff
commit beb002a
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 1 deletion.
diff --git a/NEWS b/NEWS
@@ -5,6 +5,8 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #79790 ("Illegal offset type" exception during AST evaluation
     not handled properly). (Nikita)
+  . Fixed bug #79791 (Assertion failure when unsetting variable during binary
+    op). (Nikita)
 
 09 Jul 2020, PHP 8.0.0alpha2
 

diff --git a/Zend/tests/bug79791.phpt b/Zend/tests/bug79791.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #79791: Assertion failure when unsetting variable during binary op
+--FILE--
+<?php
+set_error_handler(function() {
+    unset($GLOBALS['c']);
+});
+$c -= 1;
+var_dump($c);
+?>
+--EXPECT--
+int(-1)
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
@@ -367,8 +367,8 @@ static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_RW(uint32_t var EXECUTE_
 	zval *ret = EX_VAR(var);
 
 	if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
-		ZVAL_NULL(ret);
 		zval_undefined_cv(var EXECUTE_DATA_CC);
+		ZVAL_NULL(ret);
 		return ret;
 	}
 	return ret;