Disallow getting reference of unset readonly property

Closes GH-7942

Author: iluuu1994

NEWS

@@ -7,6 +7,8 @@ PHP                                                                        NEWS
   . Fixed freeing of internal attribute arguments. (Bob)
   . Fixed bug GH-8070 (memory leak of internal function attribute hash).
     (Tim Düsterhus)
+  . Fixed bug GH-7942 (Disallow getting reference of unset readonly property).
+    (ilutov)
 
 - Intl:
   . Fixed bug GH-8115 (Can't catch arg type deprecation when instantiating Intl

Zend/tests/readonly_props/array_append_initialization.phpt

@@ -19,7 +19,11 @@ function init() {
     var_dump($c->a);
 }
 
-(new C)->init();
+try {
+    (new C)->init();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
 
 try {
     init();
@@ -29,8 +33,5 @@ try {
 
 ?>
 --EXPECT--
-array(1) {
-  [0]=>
-  int(1)
-}
+Cannot modify readonly property C::$a
 Cannot initialize readonly property C::$a from global scope

Zend/tests/readonly_props/gh7942.phpt

@@ -0,0 +1,22 @@
+--TEST--
+GH-7942: Disallow getting reference from unset readonly property
+--FILE--
+<?php
+
+class Foo {
+    public readonly int $bar;
+    public function __construct(int &$bar) {
+        $this->bar = &$bar;
+    }
+}
+
+try {
+    $i = 42;
+    new Foo($i);
+} catch (Error $e) {
+    echo $e->getMessage(), PHP_EOL;
+}
+
+?>
+--EXPECT--
+Cannot modify readonly property Foo::$bar

Zend/zend_object_handlers.c

@@ -1020,8 +1020,10 @@ ZEND_API zval *zend_std_get_property_ptr_ptr(zend_object *zobj, zend_string *nam
 						ZVAL_NULL(retval);
 						zend_error(E_WARNING, "Undefined property: %s::$%s", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
 					}
-				} else if (prop_info && UNEXPECTED(prop_info->flags & ZEND_ACC_READONLY)
-					&& !verify_readonly_initialization_access(prop_info, zobj->ce, name, "initialize")) {
+				} else if (prop_info && UNEXPECTED(prop_info->flags & ZEND_ACC_READONLY)) {
+					if (verify_readonly_initialization_access(prop_info, zobj->ce, name, "initialize")) {
+						zend_readonly_property_modification_error(prop_info);
+					}
 					retval = &EG(error_zval);
 				}
 			} else {

ext/opcache/tests/jit/fetch_obj_006.phpt

@@ -21,11 +21,10 @@ $appendProp2 = (function() {
     $this->prop[] = 1;
 })->bindTo($test, Test::class);
 $appendProp2();
-$appendProp2();
 ?>
 --EXPECTF--
 Fatal error: Uncaught Error: Cannot modify readonly property Test::$prop in %sfetch_obj_006.php:13
 Stack trace:
-#0 %sfetch_obj_006.php(16): Test->{closure}()
+#0 %sfetch_obj_006.php(15): Test->{closure}()
 #1 {main}
   thrown in %sfetch_obj_006.php on line 13