Fixed bug #78644

Make sure the initialize the result of FETCH_OBJ_UNSET operations.
I'm using a NULL value rather than ERROR here, because the latter
no longer exists in master.

Author: nikic

NEWS

@@ -8,6 +8,8 @@ PHP                                                                        NEWS
   . Fixed bug #78620 (Out of memory error). (cmb, Nikita)
   . Fixed bug #78632 (method_exists() in php74 works differently from php73 in
     checking priv. methods). (Nikita)
+  . Fixed bug #78644 (SEGFAULT in ZEND_UNSET_OBJ_SPEC_VAR_CONST_HANDLER).
+    (Nikita)
 
 - Iconv:
   . Fixed bug #78642 (Wrong libiconv version displayed). (gedas at martynas,

Zend/tests/bug78644.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #78644: SEGFAULT in ZEND_UNSET_OBJ_SPEC_VAR_CONST_HANDLER
+--FILE--
+<?php
+
+$a = new stdClass;
+unset($a->b->c->d);
+unset($a->b->c['d']);
+var_dump($a);
+
+?>
+--EXPECT--
+object(stdClass)#1 (1) {
+  ["b"]=>
+  NULL
+}

Zend/zend_execute.c

@@ -2765,6 +2765,7 @@ static zend_always_inline void zend_fetch_property_address(zval *result, zval *c
 
 			/* this should modify object only if it's empty */
 			if (type == BP_VAR_UNSET) {
+				ZVAL_NULL(result);
 				return;
 			}