Repository navigation
Conversation
adapik
marked this pull request as draft
October 30, 2026 19:45
adapik
changed the title
adapik
force-pushed
the
fix-assign-obj-typed-prop-released-object
branch
from
October 30, 2026 20:09
6bd6e95 to
34811d4
Compare
adapik
force-pushed
the
fix-assign-obj-typed-prop-released-object
branch
from
October 30, 2026 20:16
34811d4 to
919a561
Compare
adapik
marked this pull request as ready for review
October 30, 2026 20:20
adapik
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The slow path protects the object while the value is coerced to the property type (see
zend_std_write_property()), because that can run user code (__toString(), an error handler) which frees the object. The fast path inZEND_ASSIGN_OBJand the JIT helper don't have this check. So the same code behaves differently depending on whether the cache slot is primed: the first assignment throws "Object was released while assigning to property", the following ones write into freed memory (heap-use-after-free under ASan).This fix adds the same check to the fast path and the JIT helper, so all paths behave the same. The object is only protected when the value doesn't match the type exactly and coercion can run user code, so f.e. assigning an object to a class-typed property is not affected.
The situation is rare and artificial. Still, I think it is important that the behavior is the same on every path, regardless of whether the cache slot is primed. I found this by accident while working on #25057.