KarpelesLab / goro / 25827054165

push

github

vm: detect external slot mutation in arraySetLocal (bug79784)

When the slot cache is nil (local never initialized in this body) but
the hashtable has a value, the only way that combination can arise is
if an error handler / shutdown function / destructor wrote to the
local through the hashtable during a sub-expression that the
assignment is in the middle of (e.g. \`\$a[\$c] = 'x'\` where evaluating
\$c triggers an undefined-var warning whose handler does
\`\$GLOBALS['a'] = null\`). PHP's bug79784 fix turns this into a no-op
so the handler's final value of the local stays visible. Mirror that:
when arraySetLocal sees nil-slot-with-hashtable-set on a slot-unsafe
body, bail out instead of auto-vivifying over the handler's write.

Slot-only bodies skip the check (no external mutation is possible
when the hashtable isn't mirrored), so normal auto-vivify from an
uninitialized local still works. Explicit \`\$x = null; \$x[0] = 'a';\`
also still vivifies, because the slot now holds a non-nil null ZVal
rather than a nil pointer.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

8 of 11 new or added lines in 1 file covered. (72.73%)

14017 of 115863 relevant lines covered (12.1%)

2457.22 hits per line