@@ -364,16 +364,6 @@ static zend_always_inline zval *_get_zval_ptr_cv_deref_BP_VAR_R(uint32_t var EXE
364364 return ret ;
365365}
366366
367- static zend_always_inline zval * _get_zval_ptr_cv_BP_VAR_UNSET (uint32_t var EXECUTE_DATA_DC )
368- {
369- zval * ret = EX_VAR (var );
370-
371- if (UNEXPECTED (Z_TYPE_P (ret ) == IS_UNDEF )) {
372- return zval_undefined_cv (var EXECUTE_DATA_CC );
373- }
374- return ret ;
375- }
376-
377367static zend_always_inline zval * _get_zval_ptr_cv_BP_VAR_IS (uint32_t var EXECUTE_DATA_DC )
378368{
379369 zval * ret = EX_VAR (var );
@@ -1323,11 +1313,14 @@ static zend_always_inline int zend_binary_op(zval *ret, zval *op1, zval *op2 OPL
13231313 return zend_binary_ops [opcode - ZEND_ADD ](ret , op1 , op2 );
13241314}
13251315
1326- static zend_never_inline void zend_binary_assign_op_obj_dim (zval * object , zval * property , zval * value OPLINE_DC EXECUTE_DATA_DC )
1316+ static zend_never_inline void zend_binary_assign_op_obj_dim (zval * object , zval * property OPLINE_DC EXECUTE_DATA_DC )
13271317{
1318+ zend_free_op free_op_data1 ;
1319+ zval * value ;
13281320 zval * z ;
13291321 zval rv , res ;
13301322
1323+ value = get_op_data_zval_ptr_r ((opline + 1 )-> op1_type , (opline + 1 )-> op1 , & free_op_data1 );
13311324 if ((z = Z_OBJ_HT_P (object )-> read_dimension (object , property , BP_VAR_R , & rv )) != NULL ) {
13321325
13331326 if (Z_TYPE_P (z ) == IS_OBJECT && Z_OBJ_HT_P (z )-> get ) {
@@ -1355,6 +1348,7 @@ static zend_never_inline void zend_binary_assign_op_obj_dim(zval *object, zval *
13551348 ZVAL_NULL (EX_VAR (opline -> result .var ));
13561349 }
13571350 }
1351+ FREE_OP (free_op_data1 );
13581352}
13591353
13601354static zend_never_inline void zend_binary_assign_op_typed_ref (zend_reference * ref , zval * value OPLINE_DC EXECUTE_DATA_DC )
@@ -2015,6 +2009,24 @@ static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_new_element_for_s
20152009 zend_throw_error (NULL , "[] operator not supported for strings" );
20162010}
20172011
2012+ static ZEND_COLD void zend_binary_assign_op_dim_slow (zval * container , zval * dim OPLINE_DC EXECUTE_DATA_DC )
2013+ {
2014+ zend_free_op free_op_data1 ;
2015+
2016+ if (UNEXPECTED (Z_TYPE_P (container ) == IS_STRING )) {
2017+ if (opline -> op2_type == IS_UNUSED ) {
2018+ zend_use_new_element_for_string ();
2019+ } else {
2020+ zend_check_string_offset (dim , BP_VAR_RW EXECUTE_DATA_CC );
2021+ zend_wrong_string_offset (EXECUTE_DATA_C );
2022+ }
2023+ } else if (EXPECTED (!Z_ISERROR_P (container ))) {
2024+ zend_use_scalar_as_array ();
2025+ }
2026+ get_op_data_zval_ptr_r ((opline + 1 )-> op1_type , (opline + 1 )-> op1 , & free_op_data1 );
2027+ FREE_OP (free_op_data1 );
2028+ }
2029+
20182030static zend_never_inline zend_uchar slow_index_convert (const zval * dim , zend_value * value EXECUTE_DATA_DC )
20192031{
20202032 switch (Z_TYPE_P (dim )) {
@@ -2739,6 +2751,12 @@ static zend_always_inline void zend_fetch_property_address(zval *result, zval *c
27392751 break ;
27402752 }
27412753
2754+ if (container_op_type == IS_CV
2755+ && type != BP_VAR_W
2756+ && UNEXPECTED (Z_TYPE_P (container ) == IS_UNDEF )) {
2757+ container = ZVAL_UNDEFINED_OP1 ();
2758+ }
2759+
27422760 /* this should modify object only if it's empty */
27432761 if (type == BP_VAR_UNSET ) {
27442762 return ;
0 commit comments