Delay destructor for zend_std_write_property

Author: dstogov

Zend/tests/gh10168/assign_prop.phpt

@@ -1,6 +1,5 @@
 --TEST--
 GH-10168: Assign prop
---XFAIL--
 --FILE--
 <?php
 

Zend/tests/gh10168/assign_prop_ref.phpt

@@ -1,6 +1,5 @@
 --TEST--
 GH-10168: Assign prop ref
---XFAIL--
 --FILE--
 <?php
 

Zend/tests/gh10168/assign_prop_ref_with_prop_ref.phpt

@@ -1,6 +1,5 @@
 --TEST--
 GH-10168: Assign prop ref with prop ref
---XFAIL--
 --FILE--
 <?php
 

Zend/tests/gh10168/assign_prop_with_prop_ref.phpt

@@ -1,6 +1,5 @@
 --TEST--
 GH-10168: Assign prop with prop ref
---XFAIL--
 --FILE--
 <?php
 

Zend/tests/gh10168/assign_untyped_prop.phpt

@@ -1,6 +1,5 @@
 --TEST--
 GH-10168: Assign prop
---XFAIL--
 --FILE--
 <?php
 

Zend/tests/gh10168/assign_untyped_prop_ref.phpt

@@ -1,6 +1,5 @@
 --TEST--
 GH-10168: Assign prop ref
---XFAIL--
 --FILE--
 <?php
 

Zend/tests/gh10168/assign_untyped_prop_ref_with_prop_ref.phpt

@@ -1,6 +1,5 @@
 --TEST--
 GH-10168: Assign prop ref with prop ref
---XFAIL--
 --FILE--
 <?php
 

Zend/tests/gh10168/assign_untyped_prop_with_prop_ref.phpt

@@ -1,6 +1,5 @@
 --TEST--
 GH-10168: Assign prop with prop ref
---XFAIL--
 --FILE--
 <?php
 

Zend/zend_object_handlers.c

@@ -839,9 +839,30 @@ ZEND_API zval *zend_std_write_property(zend_object *zobj, zend_string *name, zva
 				value = &tmp;
 			}
 
-found:
-			variable_ptr = zend_assign_to_variable(
-				variable_ptr, value, IS_TMP_VAR, property_uses_strict_types());
+found:;
+			zend_refcounted *garbage = NULL;
+
+			variable_ptr = zend_assign_to_variable_ex(
+				variable_ptr, value, IS_TMP_VAR, property_uses_strict_types(), &garbage);
+
+			if (garbage) {
+				if (GC_DELREF(garbage) == 0) {
+					zend_execute_data *execute_data = EG(current_execute_data);
+					// Assign to result variable before calling the destructor as it may release the object
+					if (execute_data
+					 && EX(func)
+					 && ZEND_USER_CODE(EX(func)->common.type)
+					 && EX(opline)
+					 && EX(opline)->opcode == ZEND_ASSIGN_OBJ
+					 && EX(opline)->result_type) {
+						ZVAL_COPY_DEREF(EX_VAR(EX(opline)->result.var), variable_ptr);
+						variable_ptr = NULL;
+					}
+					rc_dtor_func(garbage);
+				} else {
+					gc_check_possible_root_no_ref(garbage);
+				}
+			}
 			goto exit;
 		}
 		if (Z_PROP_FLAG_P(variable_ptr) & IS_PROP_UNINIT) {

Zend/zend_vm_def.h

@@ -2494,7 +2494,7 @@ ZEND_VM_C_LABEL(fast_assign_obj):
 	}
 
 ZEND_VM_C_LABEL(free_and_exit_assign_obj):
-	if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
+	if (UNEXPECTED(RETURN_VALUE_USED(opline)) && value) {
 		ZVAL_COPY_DEREF(EX_VAR(opline->result.var), value);
 	}
 	FREE_OP_DATA();