Bug #69955 [Asn]: Segfault when trying to combine [] and assign-op on ArrayAccess object

Edit report at https://bugs.php.net/bug.php?id=69955&edit=1 ID: 69955 Updated by: laruence@php.net Reported by: stas@php.net Summary: Segfault when trying to combine [] and assign-op on ArrayAccess object Status: Assigned Type: Bug Package: Reproducible crash Operating System: * PHP Version: 7.0Git-2015-06-28 (Git) Assigned To: dmitry Block user comment: N Private report: N New Comment: what I get is: Inside C10::offsetGet PHP Notice: Undefined variable: offset in /tmp/1.php on line 10 Notice: Undefined variable: offset in /tmp/1.php on line 10 NULL PHP Notice: Indirect modification of overloaded element of C10 has no effect in /tmp/1.php on line 24 Notice: Indirect modification of overloaded element of C10 has no effect in /tmp/1.php on line 24 php: /home/huixinchen/opensource/trunk/Zend/zend_vm_execute.h:34205: zend_binary_assign_op_dim_helper_SPEC_CV_UNUSED: Assertion `zval_get_type(&(rv)) == 15' failed. Aborted (core dumped) and zend_fetch_dimension_address_RW may really don't return a IS_INDRECT value. thanks Previous Comments: ------------------------------------------------------------------------ [2015-06-28 05:20:30] stas@php.net Description: ------------ When applying assign-operator (like +=) to result of $a[] when $a is an object implementing ArrayAccess, segfault happens. Test script: --------------- <?php class C10 implements ArrayAccess { function offsetExists($offset) { echo "\nInside " . __METHOD__ . "\n"; var_dump($offset); } function offsetGet($offset) { echo "\nInside " . __METHOD__ . "\n"; var_dump($offset); return 100; } function offsetSet($offset, $value) { echo "\nInside " . __METHOD__ . "\n"; var_dump($offset); var_dump($value); } function offsetUnset($offset) { echo "\nInside " . __METHOD__ . "\n"; var_dump($offset); } } $c10 = new C10; var_dump($c10[] += 5); Expected result: ---------------- No segfault Actual result: -------------- Inside C10::offsetGet NULL Segmentation fault: 11 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=69955&edit=1