Merge branch 'PHP-8.4'

* PHP-8.4: Fix GH-17447: Assertion failure when array popping a self addressing variable
php · Jan 16, 2025 · d0d8e68 · d0d8e68
2 parents a4fa1e7 + ae3ab37
commit d0d8e68
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 2 deletions.
diff --git a/ext/standard/array.c b/ext/standard/array.c
@@ -3571,7 +3571,8 @@ PHP_FUNCTION(array_pop)
 				break;
 			}
 		}
-		RETVAL_COPY_DEREF(val);
+		RETVAL_COPY_VALUE(val);
+		ZVAL_UNDEF(val);
 
 		if (idx == (Z_ARRVAL_P(stack)->nNextFreeElement - 1)) {
 			Z_ARRVAL_P(stack)->nNextFreeElement = Z_ARRVAL_P(stack)->nNextFreeElement - 1;
@@ -3595,7 +3596,8 @@ PHP_FUNCTION(array_pop)
 				break;
 			}
 		}
-		RETVAL_COPY_DEREF(val);
+		RETVAL_COPY_VALUE(val);
+		ZVAL_UNDEF(val);
 
 		if (!p->key && (zend_long)p->h == (Z_ARRVAL_P(stack)->nNextFreeElement - 1)) {
 			Z_ARRVAL_P(stack)->nNextFreeElement = Z_ARRVAL_P(stack)->nNextFreeElement - 1;
@@ -3605,6 +3607,10 @@ PHP_FUNCTION(array_pop)
 		zend_hash_del_bucket(Z_ARRVAL_P(stack), p);
 	}
 	zend_hash_internal_pointer_reset(Z_ARRVAL_P(stack));
+
+	if (Z_ISREF_P(return_value)) {
+		zend_unwrap_reference(return_value);
+	}
 }
 /* }}} */
 

diff --git a/ext/standard/tests/array/gh17447.phpt b/ext/standard/tests/array/gh17447.phpt
@@ -0,0 +1,12 @@
+--TEST--
+GH-17447 (Assertion failure when array poping a self addressing variable)
+--FILE--
+<?php
+$input[] = &$input;
+var_dump(array_pop($input), $input);
+?>
+--EXPECT--
+array(0) {
+}
+array(0) {
+}