From 48ecde29bb967b231eaa40fb748c444ede00fbdf Mon Sep 17 00:00:00 2001
From: Ilija Tovilo <ilija.tovilo@me.com>
Date: Thu, 28 Jul 2022 10:40:10 +0200
Subject: [PATCH] Fix property fetch on magic constants in constant expressions

Closes GH-9136
Closes GH-9138
---
 Zend/tests/gh9136.phpt | 10 ++++++++++
 Zend/tests/gh9138.phpt | 11 +++++++++++
 Zend/zend_compile.c    |  4 ++++
 3 files changed, 25 insertions(+)
 create mode 100644 Zend/tests/gh9136.phpt
 create mode 100644 Zend/tests/gh9138.phpt

diff --git a/Zend/tests/gh9136.phpt b/Zend/tests/gh9136.phpt
new file mode 100644
index 0000000000000..22c4a056520d6
--- /dev/null
+++ b/Zend/tests/gh9136.phpt
@@ -0,0 +1,10 @@
+--TEST--
+GH-9136: Assertion when fetching property of magic constant in constant expression
+--FILE--
+<?php
+
+const C = __file__->foo;
+
+?>
+--EXPECTF--
+Warning: Attempt to read property "foo" on string in %s on line %d
diff --git a/Zend/tests/gh9138.phpt b/Zend/tests/gh9138.phpt
new file mode 100644
index 0000000000000..33550580527e0
--- /dev/null
+++ b/Zend/tests/gh9138.phpt
@@ -0,0 +1,11 @@
+--TEST--
+GH-9138: NULL pointer dereference when fetching property of "bad" list in constant expression
+--FILE--
+<?php
+
+#[Attribute([,]->e)]
+class Foo {}
+
+?>
+--EXPECTF--
+Fatal error: Cannot use empty array elements in arrays in %s on line %d
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 7dd3d598df10a..ff7c9b152cd7e 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -10616,6 +10616,10 @@ static void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */
 		case ZEND_AST_CONST_ENUM_INIT:
 			zend_eval_const_expr(&ast->child[2]);
 			return;
+		case ZEND_AST_PROP:
+			zend_eval_const_expr(&ast->child[0]);
+			zend_eval_const_expr(&ast->child[1]);
+			return;
 		default:
 			return;
 	}