Bug #75393 [Opn]: Crash when assign-adding an array to an object

Edit report at https://bugs.php.net/bug.php?id=75393&edit=1 ID: 75393 Updated by: laruence@php.net Reported by: bwoebi@php.net Summary: Crash when assign-adding an array to an object Status: Open Type: Bug Package: Reproducible crash Operating System: Irrelevant PHP Version: 7.0Git-2017-10-16 (Git) Block user comment: N Private report: N New Comment: why not? <?php $o = new Stdclass(); var_dump((int)$o); output: PHP Notice: Object of class stdClass could not be converted to int in /tmp/1.php on line 3 int(1) and for: $o += [] we preparing operands first, then trying to do add, then result in unsupported operand, which seems reasonable to me Previous Comments: ------------------------------------------------------------------------ [2017-10-17 10:15:32] bwoebi@php.net @laruence: It doesn't crash with master, yes. But it still does with PHP 7.0 and 7.1. Also $o must not be int(1), but must be an instanceof stdClass afterwards. ------------------------------------------------------------------------ [2017-10-17 03:53:50] laruence@php.net this seems already be fixed: https://3v4l.org/oF3Al ------------------------------------------------------------------------ [2017-10-17 03:49:13] laruence@php.net I can not reproduce this.... ------------------------------------------------------------------------ [2017-10-17 01:42:20] bwoebi@php.net Related To: Bug #75393 ------------------------------------------------------------------------ [2017-10-17 01:42:19] bwoebi@php.net Unassigning myself, there's a deeper rabbit hole than expected. The fix I attempted for the attached test to give the expected result is causing memory leaks in other tests. Also, related issue: $rsrc += 1; leaks the resource. --TEST-- Bug #75393 (Crash when assign-adding an array to an object) --FILE-- <?php try { $o = new stdClass; $o += []; } catch (\Error $e) { var_dump($e->getMessage(), $o); } ?> --EXPECTF-- Notice: Object of class stdClass could not be converted to int in %s on line %d string(25) "Unsupported operand types" object(stdClass)#1 (0) { } ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=75393 -- Edit this bug report at https://bugs.php.net/bug.php?id=75393&edit=1