Bug #78151 [Ver]: Segfault caused by indirect expressions in PHP 7.4a1

Edit report at https://bugs.php.net/bug.php?id=78151&edit=1 ID: 78151 Updated by: krakjoe@php.net Reported by: jfcherng at gmail dot com Summary: Segfault caused by indirect expressions in PHP 7.4a1 Status: Verified Type: Bug Package: Scripting Engine problem Operating System: Win7 x64 PHP Version: Next Minor Version -Assigned To: +Assigned To: dmitry Block user comment: N Private report: N New Comment: My mistake, a95014dc101756d93696c5c283578302a8334edd is the bad commit ... Previous Comments: ------------------------------------------------------------------------ [2019-06-13 05:41:02] krakjoe@php.net Bisected ... Okay at: 3820296c42e146cc080bc24314ccdfdd700e743e Fault introduced by merge: dbd1ecd09f26015451063c6d545c9ab929a12129 Revert of be74ca497680ef544af1f650fe4717a3e0d0af67 fixes fault ------------------------------------------------------------------------ [2019-06-12 20:47:11] krakjoe@php.net First 7.4 build: https://dev.azure.com/phpazuredevops/PHP/_build/results?buildId=173 ------------------------------------------------------------------------ [2019-06-12 20:46:20] krakjoe@php.net Test added, first CI build that includes it is: https://dev.azure.com/phpazuredevops/PHP/_build/results?buildId=172 ------------------------------------------------------------------------ [2019-06-12 20:01:20] nikic@php.net Also repros on Ubuntu for me. ------------------------------------------------------------------------ [2019-06-12 19:54:39] jfcherng at gmail dot com Description: ------------ I downloaded the PHP 7.4 alpha 1 release from "https://windows.php.net/downloads/qa/php-7.4.0alpha1-nts-Win32-vs16-x64.zip" and decompressed it without any modification (I did not even create a php.ini). I then ran the attached test script with the PHP QA release ( $ php.exe test.php ) and got a segfault. I *cannot* reproduce this issue on my CentOS machine somehow. Test script: --------------- <?php class Arr { private $foo = ''; public function __construct(array $array = []) { $property = 'foo'; // segfault in PHP 7.4.0alpha1 but is fine in PHP 7.3.7RC1 $this->{$property} = &$array[$property]; // this is fine in both PHP versions // $this->foo = &$array[$property]; \var_dump($this->foo); } } $arr = new Arr(['foo' => 'bar']); Expected result: ---------------- string(3) "bar" Actual result: -------------- Segmentation fault ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78151&edit=1