Merge branch 'PHP-8.3' into PHP-8.4

nielsdos · nielsdos · commit b47c3b633d68 · 2025-10-07T20:17:00.000+02:00
* PHP-8.3: Fix GH-20073: Assertion failure in WeakMap offset operations on reference
diff --git a/NEWS b/NEWS
@@ -4,6 +4,8 @@ PHP                                                                        NEWS
 
 - Core:
   . Fixed bug GH-19934 (CGI with auto_globals_jit=0 causes uouv). (ilutov)
+  . Fixed bug GH-20073 (Assertion failure in WeakMap offset operations on
+    reference). (nielsdos)
 
 09 Oct 2025, PHP 8.4.14
 
diff --git a/Zend/tests/weakrefs/gh20073.phpt b/Zend/tests/weakrefs/gh20073.phpt
@@ -0,0 +1,15 @@
+--TEST--
+GH-20073 (Assertion failure in WeakMap offset operations on reference)
+--FILE--
+<?php
+$obj = new stdClass;
+$map = new WeakMap;
+$integer = 1;
+$map[$obj] = 0;
+$map[$obj] =& $integer;
+$integer++;
+var_dump($map[$obj], $map->offsetGet($obj));
+?>
+--EXPECT--
+int(2)
+int(2)
diff --git a/Zend/zend_weakrefs.c b/Zend/zend_weakrefs.c
@@ -722,7 +722,7 @@ ZEND_METHOD(WeakMap, offsetGet)
 		RETURN_THROWS();
 	}
 
-	ZVAL_COPY(return_value, zv);
+	RETURN_COPY_DEREF(zv);
 }
 
 ZEND_METHOD(WeakMap, offsetSet)

Original file line number	Diff line number	Diff line change
`@@ -722,7 +722,7 @@ ZEND_METHOD(WeakMap, offsetGet)`
`722`	`722`	`RETURN_THROWS();`
`723`	`723`	`}`
`724`	`724`
`725`		`- ZVAL_COPY(return_value, zv);`
	`725`	`+ RETURN_COPY_DEREF(zv);`
`726`	`726`	`}`
`727`	`727`
`728`	`728`	`ZEND_METHOD(WeakMap, offsetSet)`