diff --git a/Zend/tests/bug79779.phpt b/Zend/tests/bug79779.phpt new file mode 100644 index 00000000000..fe11ed76cc9 --- /dev/null +++ b/Zend/tests/bug79779.phpt @@ -0,0 +1,12 @@ +--TEST-- +Bug #79779: Assertion failure when assigning property of string offset by reference +--FILE-- +a = &$b; +?> +--EXPECTF-- +Fatal error: Uncaught Error: Cannot use string offset as an object in %s:%d +Stack trace: +#0 {main} + thrown in %s on line %d diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index 5df8345c762..4efb80bc728 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -1417,9 +1417,21 @@ static zend_never_inline ZEND_COLD void zend_wrong_string_offset(EXECUTE_DATA_D) while (opline < end) { if (opline->op1_type == IS_VAR && opline->op1.var == var) { switch (opline->opcode) { + case ZEND_FETCH_OBJ_W: + case ZEND_FETCH_OBJ_RW: + case ZEND_FETCH_OBJ_FUNC_ARG: + case ZEND_FETCH_OBJ_UNSET: + case ZEND_ASSIGN_OBJ: case ZEND_ASSIGN_OBJ_OP: + case ZEND_ASSIGN_OBJ_REF: msg = "Cannot use string offset as an object"; break; + case ZEND_FETCH_DIM_W: + case ZEND_FETCH_DIM_RW: + case ZEND_FETCH_DIM_FUNC_ARG: + case ZEND_FETCH_DIM_UNSET: + case ZEND_FETCH_LIST_W: + case ZEND_ASSIGN_DIM: case ZEND_ASSIGN_DIM_OP: msg = "Cannot use string offset as an array"; break; @@ -1437,21 +1449,6 @@ static zend_never_inline ZEND_COLD void zend_wrong_string_offset(EXECUTE_DATA_D) case ZEND_POST_DEC: msg = "Cannot increment/decrement string offsets"; break; - case ZEND_FETCH_DIM_W: - case ZEND_FETCH_DIM_RW: - case ZEND_FETCH_DIM_FUNC_ARG: - case ZEND_FETCH_DIM_UNSET: - case ZEND_FETCH_LIST_W: - case ZEND_ASSIGN_DIM: - msg = "Cannot use string offset as an array"; - break; - case ZEND_FETCH_OBJ_W: - case ZEND_FETCH_OBJ_RW: - case ZEND_FETCH_OBJ_FUNC_ARG: - case ZEND_FETCH_OBJ_UNSET: - case ZEND_ASSIGN_OBJ: - msg = "Cannot use string offset as an object"; - break; case ZEND_ASSIGN_REF: case ZEND_ADD_ARRAY_ELEMENT: case ZEND_INIT_ARRAY: