From 0301ab70b34b4ac7db5b469a16d3b5309f6217c6 Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikita.ppv@gmail.com>
Date: Wed, 18 Dec 2019 09:53:30 +0100
Subject: [PATCH] Fix const/cv freeing on failed reference assignment

---
 .../typed_properties_106.phpt                 | 26 +++++++++++++++++++
 Zend/zend_execute.c                           |  4 ++-
 2 files changed, 29 insertions(+), 1 deletion(-)
 create mode 100644 Zend/tests/type_declarations/typed_properties_106.phpt

diff --git a/Zend/tests/type_declarations/typed_properties_106.phpt b/Zend/tests/type_declarations/typed_properties_106.phpt
new file mode 100644
index 00000000000..344cfa5349e
--- /dev/null
+++ b/Zend/tests/type_declarations/typed_properties_106.phpt
@@ -0,0 +1,26 @@
+--TEST--
+CONST/CV should not be freed on failed reference assignment
+--FILE--
+<?php
+class Test {
+    public ?Type $prop;
+}
+$obj = new Test;
+$ref =& $obj->prop;
+try {
+    $ref = [1];
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    $ary = [1];
+    $ref = $ary;
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+var_dump($ref);
+?>
+--EXPECT--
+Cannot assign array to reference held by property Test::$prop of type ?Type
+Cannot assign array to reference held by property Test::$prop of type ?Type
+NULL
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 3611c5b008a..c1ff85bff86 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -3187,7 +3187,9 @@ ZEND_API zval* zend_assign_to_typed_ref(zval *variable_ptr, zval *value, zend_uc
 		Z_TRY_DELREF_P(value);
 	}
 	if (!ret) {
-		zval_ptr_dtor(value);
+		if (value_type & (IS_VAR|IS_TMP_VAR)) {
+			zval_ptr_dtor(value);
+		}
 		return Z_REFVAL_P(variable_ptr);
 	}