From 4f0554fa549e02b172afcbd17bac20cac1cd5b47 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Wed, 4 Jun 2025 20:07:13 +0200
Subject: [PATCH] Properly handle __debugInfo() returning an array reference

Currently, this fails because the type is IS_REFERENCE instead of
IS_ARRAY, but this could be confusing because a function return value is
normally dereferenced automatically in a lot of cases.

Closes GH-18762.
---
 NEWS                                  |  1 +
 Zend/tests/__debugInfo_reference.phpt | 22 ++++++++++++++++++++++
 Zend/zend_object_handlers.c           |  3 +++
 3 files changed, 26 insertions(+)
 create mode 100644 Zend/tests/__debugInfo_reference.phpt

diff --git a/NEWS b/NEWS
index 9e6d47ed2a0..deae7fdbecc 100644
--- a/NEWS
+++ b/NEWS
@@ -14,6 +14,7 @@ PHP                                                                        NEWS
   . Drop support for -z CLI/CGI flag. (nielsdos)
   . Fixed GH-17956 - development server 404 page does not adapt to mobiles.
     (pascalchevrel)
+  . Properly handle __debugInfo() returning an array reference. (nielsdos)
 
 - CURL:
   . Added CURLFOLLOW_ALL, CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY
diff --git a/Zend/tests/__debugInfo_reference.phpt b/Zend/tests/__debugInfo_reference.phpt
new file mode 100644
index 00000000000..8b5519f4089
--- /dev/null
+++ b/Zend/tests/__debugInfo_reference.phpt
@@ -0,0 +1,22 @@
+--TEST--
+__debugInfo with reference return
+--FILE--
+<?php
+
+class Test {
+    private $tmp = ['x' => 1];
+
+    public function &__debugInfo(): array
+    {
+        return $this->tmp;
+    }
+}
+
+var_dump(new Test);
+
+?>
+--EXPECT--
+object(Test)#1 (1) {
+  ["x"]=>
+  int(1)
+}
diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index ba26ac7128a..f79023ade1c 100644
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -206,6 +206,9 @@ ZEND_API HashTable *zend_std_get_debug_info(zend_object *object, int *is_temp) /
 	}
 
 	zend_call_known_instance_method_with_0_params(ce->__debugInfo, object, &retval);
+	if (UNEXPECTED(Z_ISREF(retval))) {
+		zend_unwrap_reference(&retval);
+	}
 	if (Z_TYPE(retval) == IS_ARRAY) {
 		if (!Z_REFCOUNTED(retval)) {
 			*is_temp = 1;