Allow readonly properties to be reset once during cloning

Co-Authored-By: Arnaud Le Blanc <arnaud.lb@gmail.com>

Author: kocsismate

Zend/Optimizer/compact_literals.c

@@ -558,6 +558,7 @@ void zend_optimizer_compact_literals(zend_op_array *op_array, zend_optimizer_ctx
 					break;
 				case ZEND_ASSIGN_OBJ:
 				case ZEND_ASSIGN_OBJ_REF:
+				case ZEND_CLONE_INIT_PROP:
 				case ZEND_FETCH_OBJ_R:
 				case ZEND_FETCH_OBJ_W:
 				case ZEND_FETCH_OBJ_RW:

Zend/Optimizer/zend_inference.c

@@ -2310,7 +2310,8 @@ static zend_always_inline zend_result _zend_update_type_info(
 	   || opline->opcode == ZEND_ASSIGN_OBJ_OP
 	   || opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP
 	   || opline->opcode == ZEND_ASSIGN_DIM
-	   || opline->opcode == ZEND_ASSIGN_OBJ)
+	   || opline->opcode == ZEND_ASSIGN_OBJ
+	   || opline->opcode == ZEND_CLONE_INIT_PROP)
 	    && !(OP1_DATA_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS)) /*&& 0*/)) {
 		tmp = 0;
 		if (ssa_op->result_def >= 0 && !(ssa_var_info[ssa_op->result_def].type & MAY_BE_REF)) {
@@ -2326,7 +2327,8 @@ static zend_always_inline zend_result _zend_update_type_info(
 		 || opline->opcode == ZEND_ASSIGN_OBJ_OP
 		 || opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP
 		 || opline->opcode == ZEND_ASSIGN_DIM
-		 || opline->opcode == ZEND_ASSIGN_OBJ) {
+		 || opline->opcode == ZEND_ASSIGN_OBJ
+		 || opline->opcode == ZEND_CLONE_INIT_PROP) {
 			if ((ssa_op+1)->op1_def >= 0 && !(ssa_var_info[(ssa_op+1)->op1_def].type & MAY_BE_REF)) {
 				UPDATE_SSA_TYPE(tmp, (ssa_op+1)->op1_def);
 			}
@@ -2756,6 +2758,7 @@ static zend_always_inline zend_result _zend_update_type_info(
 			}
 			break;
 		case ZEND_ASSIGN_OBJ:
+		case ZEND_CLONE_INIT_PROP:
 			if (opline->op1_type == IS_CV) {
 				tmp = (t1 & (MAY_BE_REF|MAY_BE_OBJECT))|MAY_BE_RC1|MAY_BE_RCN;
 				UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
@@ -3385,6 +3388,7 @@ static zend_always_inline zend_result _zend_update_type_info(
 							case ZEND_ASSIGN_OBJ:
 							case ZEND_ASSIGN_OBJ_OP:
 							case ZEND_ASSIGN_OBJ_REF:
+							case ZEND_CLONE_INIT_PROP:
 							case ZEND_PRE_INC_OBJ:
 							case ZEND_PRE_DEC_OBJ:
 							case ZEND_POST_INC_OBJ:
@@ -4809,6 +4813,41 @@ ZEND_API bool zend_may_throw_ex(const zend_op *opline, const zend_ssa_op *ssa_op
 				}
 			}
 			return 1;
+		case ZEND_CLONE_INIT_PROP:
+			if (t1 & (MAY_BE_ANY-MAY_BE_OBJECT)) {
+				return 1;
+			}
+			if (ssa_op->op1_use) {
+				zend_ssa_var_info *var_info = ssa->var_info + ssa_op->op1_use;
+				zend_class_entry *ce = var_info->ce;
+
+				if (var_info->is_instanceof ||
+				    !ce || ce->create_object || ce->__get || ce->__set || ce->parent) {
+					return 1;
+				}
+
+				if (opline->op2_type != IS_CONST) {
+					return 1;
+				}
+
+				zend_string *prop_name = Z_STR_P(CRT_CONSTANT(opline->op2));
+				if (ZSTR_LEN(prop_name) > 0 && ZSTR_VAL(prop_name)[0] == '\0') {
+					return 1;
+				}
+
+				zend_property_info *prop_info =
+					zend_hash_find_ptr(&ce->properties_info, prop_name);
+				if (prop_info) {
+					if (ZEND_TYPE_IS_SET(prop_info->type)) {
+						return 1;
+					}
+					return !(prop_info->flags & ZEND_ACC_PUBLIC)
+						&& prop_info->ce != op_array->scope;
+				} else {
+					return !(ce->ce_flags & ZEND_ACC_ALLOW_DYNAMIC_PROPERTIES);
+				}
+			}
+			return 1;
 		case ZEND_ROPE_INIT:
 		case ZEND_ROPE_ADD:
 		case ZEND_ROPE_END:

Zend/Optimizer/zend_optimizer.c

@@ -533,6 +533,7 @@ bool zend_optimizer_update_op2_const(zend_op_array *op_array,
 			break;
 		case ZEND_ASSIGN_OBJ:
 		case ZEND_ASSIGN_OBJ_REF:
+		case ZEND_CLONE_INIT_PROP:
 		case ZEND_FETCH_OBJ_R:
 		case ZEND_FETCH_OBJ_W:
 		case ZEND_FETCH_OBJ_RW:

Zend/Optimizer/zend_ssa.c

@@ -588,6 +588,7 @@ static zend_always_inline int _zend_ssa_rename_op(const zend_op_array *op_array,
 			break;
 		case ZEND_ASSIGN_DIM:
 		case ZEND_ASSIGN_OBJ:
+		case ZEND_CLONE_INIT_PROP:
 			next = opline + 1;
 			if (next->op1_type & (IS_CV|IS_VAR|IS_TMP_VAR)) {
 				ssa_ops[k + 1].op1_use = var[EX_VAR_TO_NUM(next->op1.var)];

Zend/tests/clone_initializer/clone_initializer_error1.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Test that the property initializer list is required when "with" is given
+--FILE--
+<?php
+
+class Foo
+{
+    public function withProperties()
+    {
+        return clone $this with;
+    }
+}
+
+?>
+--EXPECTF--
+Parse error: syntax error, unexpected token ";", expecting "{" in %s on line %d

Zend/tests/clone_initializer/clone_initializer_error2.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Test that the property initializer list cannot contain invalid identifiers when using the : syntax
+--FILE--
+<?php
+
+class Foo
+{
+    public function withProperties()
+    {
+        return clone $this with {1: "value"};
+    }
+}
+
+?>
+--EXPECTF--
+Parse error: syntax error, unexpected token ":" in %s on line %d

Zend/tests/clone_initializer/clone_initializer_error3.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Test that the clone property initializer respects visibility
+--FILE--
+<?php
+
+class Foo
+{
+    private $bar;
+}
+
+$foo = new Foo();
+
+try {
+    $foo = clone $foo with {bar: 1};
+} catch (Error $exception) {
+    echo $exception->getMessage() . "\n";
+}
+
+?>
+--EXPECT--
+Cannot access private property Foo::$bar

Zend/tests/clone_initializer/clone_initializer_error4.phpt

@@ -0,0 +1,31 @@
+--TEST--
+Test that readonly properties cannot be assigned in "cloned with" multiple times
+--FILE--
+<?php
+
+class Foo
+{
+    public function __construct(
+        public readonly int $bar
+    ) {}
+
+    public function with()
+    {
+        return clone $this with {
+            bar: 1,
+            bar: 2,
+        };
+    }
+}
+
+$foo = new Foo(0);
+
+try {
+    $foo->with();
+} catch (Error $exception) {
+    echo $exception->getMessage() . "\n";
+}
+
+?>
+--EXPECT--
+Cannot modify readonly property Foo::$bar

Zend/tests/clone_initializer/clone_initializer_error5.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Test TypeError during "clone with"
+--FILE--
+<?php
+
+class Foo
+{
+    public int $bar = 1;
+}
+
+$obj1 = new Foo();
+
+try {
+    clone $obj1 with {bar: []};
+} catch (TypeError $e) {
+    echo $e->getMessage() . "\n";
+}
+
+try {
+    clone $obj1 with {bar: []}; // The same as above but now using cache slots
+} catch (TypeError $e) {
+    echo $e->getMessage() . "\n";
+}
+
+?>
+--EXPECT--
+Cannot assign array to property Foo::$bar of type int
+Cannot assign array to property Foo::$bar of type int

Zend/tests/clone_initializer/clone_initializer_error6.phpt

@@ -0,0 +1,34 @@
+--TEST--
+Test "clone with" with a declared untyped property of an object throwing an exception in the destructor
+--FILE--
+<?php
+
+class Foo
+{
+    public $bar;
+
+    public function __destruct() {
+        throw new Exception("Error in destructor");
+    }
+}
+
+function returnFoo() {
+    return new Foo();
+}
+
+try {
+    clone returnFoo() with {bar: new stdClass()};
+} catch (Exception $e) {
+    echo $e->getMessage() . "\n";
+}
+
+try {
+    clone returnFoo() with {bar: new stdClass()}; // The same as above but now using cache slots
+} catch (Exception $e) {
+    echo $e->getMessage() . "\n";
+}
+
+?>
+--EXPECT--
+Error in destructor
+Error in destructor

Zend/tests/clone_initializer/clone_initializer_error7.phpt

@@ -0,0 +1,33 @@
+--TEST--
+Test "clone with" with dynamic properties of an object throwing an exception in the destructor
+--FILE--
+<?php
+
+#[AllowDynamicProperties]
+class Foo
+{
+    public function __destruct() {
+        throw new Exception("Error in destructor");
+    }
+}
+
+function returnFoo() {
+    return new Foo();
+}
+
+try {
+    clone returnFoo() with {bar: new stdClass()};
+} catch (Exception $e) {
+    echo $e->getMessage() . "\n";
+}
+
+try {
+    clone returnFoo() with {bar: new stdClass()}; // The same as above but now using cache slots
+} catch (Exception $e) {
+    echo $e->getMessage() . "\n";
+}
+
+?>
+--EXPECT--
+Error in destructor
+Error in destructor

Zend/tests/clone_initializer/clone_initializer_error8.phpt

@@ -0,0 +1,66 @@
+--TEST--
+Test "clone with" with invalid property names
+--FILE--
+<?php
+
+try {
+    clone new stdClass() with {$undefined => 1};
+} catch (TypeError $e) {
+    echo $e->getMessage() . "\n";
+}
+
+try {
+    clone new stdClass() with {$undefined => 1}; // The same as above but now using cache slots
+} catch (TypeError $e) {
+    echo $e->getMessage() . "\n";
+}
+
+try {
+    clone new stdClass() with {null => 1};
+} catch (TypeError $e) {
+    echo $e->getMessage() . "\n";
+}
+
+try {
+    clone new stdClass() with {null => 1}; // The same as above but now using cache slots
+} catch (TypeError $e) {
+    echo $e->getMessage() . "\n";
+}
+
+try {
+    clone new stdClass() with {[] => 1};
+} catch (TypeError $e) {
+    echo $e->getMessage() . "\n";
+}
+
+try {
+    clone new stdClass() with {[] => 1}; // The same as above but now using cache slots
+} catch (TypeError $e) {
+    echo $e->getMessage() . "\n";
+}
+
+try {
+    clone new stdClass() with {1 => 1};
+} catch (TypeError $e) {
+    echo $e->getMessage() . "\n";
+}
+
+try {
+    clone new stdClass() with {1 => 1}; // The same as above but now using cache slots
+} catch (TypeError $e) {
+    echo $e->getMessage() . "\n";
+}
+
+?>
+--EXPECTF--
+Warning: Undefined variable $undefined in %s on line %d
+Property name must be of type string, null given
+
+Warning: Undefined variable $undefined in %s on line %d
+Property name must be of type string, null given
+Property name must be of type string, null given
+Property name must be of type string, null given
+Property name must be of type string, array given
+Property name must be of type string, array given
+Property name must be of type string, int given
+Property name must be of type string, int given