Dirty solution for ref mod to typed and readonly props through ArrayIterator

Fixes GH-10844

Author: iluuu1994

Zend/tests/type_declarations/typed_properties_113.phpt

@@ -0,0 +1,26 @@
+--TEST--
+Test typed property modification by-ref through ArrayIterator
+--FILE--
+<?php
+class A implements IteratorAggregate {
+    function __construct(
+        public string $foo = 'bar'
+    ) {}
+
+    function getIterator(): Traversable {
+        return new ArrayIterator($this);
+    }
+}
+
+$obj = new A;
+foreach ($obj as $k => &$v) {
+	$v = 42;
+}
+
+var_dump($obj);
+?>
+--EXPECT--
+object(A)#1 (1) {
+  ["foo"]=>
+  &string(2) "42"
+}

Zend/tests/type_declarations/typed_properties_114.phpt

@@ -0,0 +1,26 @@
+--TEST--
+Test readonly property modification by-ref through ArrayIterator
+--FILE--
+<?php
+class A implements IteratorAggregate {
+    function __construct(
+        public readonly string $foo = 'bar'
+    ) {}
+
+    function getIterator(): Traversable {
+        return new ArrayIterator($this);
+    }
+}
+
+$obj = new A;
+foreach ($obj as $k => &$v) {
+	$v = 'baz';
+}
+
+var_dump($obj);
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Cannot acquire reference to readonly property A::$foo in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d

ext/spl/spl_array.c

@@ -1010,15 +1010,47 @@ static zval *spl_array_it_get_current_data(zend_object_iterator *iter) /* {{{ */
 	spl_array_object *object = Z_SPLARRAY_P(&iter->data);
 	HashTable *aht = spl_array_get_hash_table(object);
 
+	zval *data;
 	if (object->ar_flags & SPL_ARRAY_OVERLOADED_CURRENT) {
-		return zend_user_it_get_current_data(iter);
+		data = zend_user_it_get_current_data(iter);
 	} else {
-		zval *data = zend_hash_get_current_data_ex(aht, spl_array_get_pos_ptr(aht, object));
+		data = zend_hash_get_current_data_ex(aht, spl_array_get_pos_ptr(aht, object));
 		if (data && Z_TYPE_P(data) == IS_INDIRECT) {
 			data = Z_INDIRECT_P(data);
 		}
-		return data;
 	}
+	// ZEND_FE_FETCH_RW converts the value to a reference but doesn't know the source is a property.
+	// Typed properties must add a type source to the reference, and readonly properties must fail.
+	zend_execute_data *execute_data = EG(current_execute_data);
+	if (data
+	 && Z_TYPE_P(data) != IS_REFERENCE
+	 && execute_data
+	 && ZEND_USER_CODE(execute_data->func->type)
+	 && execute_data->opline
+	 && execute_data->opline->opcode == ZEND_FE_FETCH_RW
+	 && !(object->ar_flags & SPL_ARRAY_IS_SELF)
+	 && !(object->ar_flags & SPL_ARRAY_USE_OTHER)
+	 && Z_TYPE(object->array) == IS_OBJECT) {
+		zend_string *key;
+		zend_hash_get_current_key_ex(aht, &key, NULL, spl_array_get_pos_ptr(aht, object));
+		zend_class_entry *ce = Z_OBJCE(object->array);
+		zend_property_info *prop_info = zend_get_property_info(ce, key, true);
+		if (ZEND_TYPE_IS_SET(prop_info->type)) {
+			if (prop_info->flags & ZEND_ACC_READONLY) {
+				zend_throw_error(NULL,
+					"Cannot acquire reference to readonly property %s::$%s",
+					ZSTR_VAL(prop_info->ce->name), ZSTR_VAL(key));
+				return NULL;
+			}
+			zend_refcounted *gc = Z_COUNTED_P(data);
+			zval *ref;
+			ZVAL_NEW_EMPTY_REF(data);
+			ref = Z_REFVAL_P(data);
+			ZVAL_COPY_VALUE_EX(ref, data, gc, Z_TYPE_P(data));
+			ZEND_REF_ADD_TYPE_SOURCE(Z_REF_P(data), prop_info);
+		}
+	}
+	return data;
 }
 /* }}} */