Merge branch 'PHP-7.4' into PHP-8.0

* PHP-7.4:
  Fixed bug #81090

Author: nikic

NEWS

@@ -7,6 +7,8 @@ PHP                                                                        NEWS
     (krakjoe)
   . Fixed bug #81068 (Double free in realpath_cache_clean()). (Dimitry Andric)
   . Fixed bug #76359 (open_basedir bypass through adding ".."). (cmb)
+  . Fixed bug #81090 (Typed property performance degradation with .= operator).
+    (Nikita)
 
 - OCI8:
   . Fixed bug #81088 (error in regression test for oci_fetch_object() and

Zend/zend_execute.c

@@ -1329,6 +1329,13 @@ static zend_never_inline void zend_binary_assign_op_typed_ref(zend_reference *re
 {
 	zval z_copy;
 
+	/* Make sure that in-place concatenation is used if the LHS is a string. */
+	if (opline->extended_value == ZEND_CONCAT && Z_TYPE(ref->val) == IS_STRING) {
+		concat_function(&ref->val, &ref->val, value);
+		ZEND_ASSERT(Z_TYPE(ref->val) == IS_STRING && "Concat should return string");
+		return;
+	}
+
 	zend_binary_op(&z_copy, &ref->val, value OPLINE_CC);
 	if (EXPECTED(zend_verify_ref_assignable_zval(ref, &z_copy, EX_USES_STRICT_TYPES()))) {
 		zval_ptr_dtor(&ref->val);
@@ -1342,6 +1349,13 @@ static zend_never_inline void zend_binary_assign_op_typed_prop(zend_property_inf
 {
 	zval z_copy;
 
+	/* Make sure that in-place concatenation is used if the LHS is a string. */
+	if (opline->extended_value == ZEND_CONCAT && Z_TYPE_P(zptr) == IS_STRING) {
+		concat_function(zptr, zptr, value);
+		ZEND_ASSERT(Z_TYPE_P(zptr) == IS_STRING && "Concat should return string");
+		return;
+	}
+
 	zend_binary_op(&z_copy, zptr, value OPLINE_CC);
 	if (EXPECTED(zend_verify_property_type(prop_info, &z_copy, EX_USES_STRICT_TYPES()))) {
 		zval_ptr_dtor(zptr);