Fixed bug #79791

First throw the undefined variable warning, and then set the
variable to null. Otherwise we're not guaranteed that it's
actually null afterwards.

Author: nikic

NEWS

@@ -5,6 +5,8 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #79790 ("Illegal offset type" exception during AST evaluation
     not handled properly). (Nikita)
+  . Fixed bug #79791 (Assertion failure when unsetting variable during binary
+    op). (Nikita)
 
 09 Jul 2020, PHP 8.0.0alpha2
 

Zend/tests/bug79791.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Bug #79791: Assertion failure when unsetting variable during binary op
+--FILE--
+<?php
+set_error_handler(function() {
+    unset($GLOBALS['c']);
+});
+$c -= 1;
+var_dump($c);
+?>
+--EXPECT--
+int(-1)

Zend/zend_execute.c

@@ -367,8 +367,8 @@ static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_RW(uint32_t var EXECUTE_
 	zval *ret = EX_VAR(var);
 
 	if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
-		ZVAL_NULL(ret);
 		zval_undefined_cv(var EXECUTE_DATA_CC);
+		ZVAL_NULL(ret);
 		return ret;
 	}
 	return ret;