Backup value

Author: arnaud-lb

Zend/tests/lazy_objects/gh15999.phpt renamed to Zend/tests/lazy_objects/gh15999_001.phpt

@@ -1,5 +1,5 @@
 --TEST--
-Lazy Objects: GH-15999: Object is released during initialization
+Lazy Objects: GH-15999 001: Object is released during initialization
 --FILE--
 <?php
 
@@ -18,9 +18,10 @@ $o = $r->newLazyGhost(function ($obj) {
     global $o;
     $o = null;
 });
+$p = new stdClass;
 
 try {
-    $o->s = $o;
+    $o->s = $p;
 } catch (Error $e) {
     printf("%s: %s\n", $e::class, $e->getMessage());
 }
@@ -32,9 +33,10 @@ $o = $r->newLazyProxy(function ($obj) {
     $o = null;
     return new C();
 });
+$p = new stdClass;
 
 try {
-    $o->s = $o;
+    $o->s = $p;
 } catch (Error $e) {
     printf("%s: %s\n", $e::class, $e->getMessage());
 }
@@ -47,8 +49,9 @@ $o = $r->newLazyGhost(function ($obj) {
     $o = null;
     gc_collect_cycles();
 });
+$p = new stdClass;
 
-$o->s = $o;
+$o->s = $p;
 gc_collect_cycles();
 
 print "# Nested error (ghost):\n";
@@ -60,9 +63,10 @@ $o = $r->newLazyGhost(function ($obj) {
     $o = null;
     return new stdClass;
 });
+$p = new stdClass;
 
 try {
-    $o->s = $o;
+    $o->s = $p;
 } catch (Error $e) {
     do {
         printf("%s: %s\n", $e::class, $e->getMessage());
@@ -78,9 +82,10 @@ $o = $r->newLazyProxy(function ($obj) {
     $o = null;
     return new stdClass;
 });
+$p = new stdClass;
 
 try {
-    $o->s = $o;
+    $o->s = $p;
 } catch (Error $e) {
     do {
         printf("%s: %s\n", $e::class, $e->getMessage());

Zend/tests/lazy_objects/gh15999_002.phpt

@@ -0,0 +1,55 @@
+--TEST--
+Lazy Objects: GH-15999 002: Assigned value is changed during lazy object initialization
+--FILE--
+<?php
+
+class C {
+    public $s;
+    public function __destruct() {
+        var_dump(__METHOD__);
+    }
+}
+
+print "# Ghost:\n";
+
+$r = new ReflectionClass(C::class);
+
+$o = $r->newLazyGhost(function ($obj) {
+    global $p;
+    $p = null;
+});
+
+$p = new stdClass;
+var_dump($o->s = $p);
+var_dump($o->s);
+
+print "# Proxy:\n";
+
+$r = new ReflectionClass(C::class);
+
+$o = $r->newLazyProxy(function ($obj) {
+    global $p;
+    $p = null;
+    return new C();
+});
+
+$p = new stdClass;
+var_dump($o->s = $p);
+var_dump($o->s);
+
+?>
+==DONE==
+--EXPECTF--
+# Ghost:
+object(stdClass)#%d (0) {
+}
+object(stdClass)#%d (0) {
+}
+# Proxy:
+string(13) "C::__destruct"
+object(stdClass)#%d (0) {
+}
+object(stdClass)#%d (0) {
+}
+==DONE==
+string(13) "C::__destruct"

Zend/zend_object_handlers.c

@@ -1184,16 +1184,22 @@ found:;
 	return variable_ptr;
 
 lazy_init:
-	zobj = zend_lazy_object_init(zobj);
-	if (UNEXPECTED(!zobj)) {
-		variable_ptr = &EG(error_zval);
-		goto exit;
-	}
-	/* value may have changed during initialization */
-	if (UNEXPECTED(Z_ISREF_P(value))) {
-		value = Z_REFVAL_P(value);
+	{
+		/* backup value as it may change during initialization */
+		zval backup;
+		ZVAL_COPY(&backup, value);
+
+		zobj = zend_lazy_object_init(zobj);
+		if (UNEXPECTED(!zobj)) {
+			variable_ptr = &EG(error_zval);
+			zval_ptr_dtor(&backup);
+			goto exit;
+		}
+
+		variable_ptr = zend_std_write_property(zobj, name, &backup, cache_slot);
+		zval_ptr_dtor(&backup);
+		return variable_ptr;
 	}
-	return zend_std_write_property(zobj, name, value, cache_slot);
 }
 /* }}} */