@@ -500,16 +500,33 @@ static void ZEND_FASTCALL zend_jit_fetch_dim_r_helper(zend_array *ht, zval *dim,
500500 }
501501 ZEND_FALLTHROUGH ;
502502 case IS_NULL :
503- retval = zend_hash_find (ht , ZSTR_EMPTY_ALLOC ());
504- if (!retval ) {
505- ZVAL_NULL (result );
506- } else {
507- ZVAL_COPY_DEREF (result , retval );
503+ /* The array may be destroyed while throwing the notice.
504+ * Temporarily increase the refcount to detect this situation. */
505+ if (!(GC_FLAGS (ht ) & IS_ARRAY_IMMUTABLE )) {
506+ GC_ADDREF (ht );
508507 }
509-
508+ execute_data = EG (current_execute_data );
509+ opline = EX (opline );
510510 zend_error (E_DEPRECATED , "Using null as an array offset is deprecated, use an empty string instead" );
511-
512- return ;
511+ if (!(GC_FLAGS (ht ) & IS_ARRAY_IMMUTABLE ) && !GC_DELREF (ht )) {
512+ zend_array_destroy (ht );
513+ if (opline -> result_type & (IS_VAR | IS_TMP_VAR )) {
514+ if (EG (exception )) {
515+ ZVAL_UNDEF (EX_VAR (opline -> result .var ));
516+ } else {
517+ ZVAL_NULL (EX_VAR (opline -> result .var ));
518+ }
519+ }
520+ return ;
521+ }
522+ if (EG (exception )) {
523+ if (opline -> result_type & (IS_VAR | IS_TMP_VAR )) {
524+ ZVAL_UNDEF (EX_VAR (opline -> result .var ));
525+ }
526+ return ;
527+ }
528+ offset_key = ZSTR_EMPTY_ALLOC ();
529+ goto str_index ;
513530 case IS_DOUBLE :
514531 hval = zend_dval_to_lval (Z_DVAL_P (dim ));
515532 if (!zend_is_long_compatible (Z_DVAL_P (dim ), hval )) {
@@ -650,16 +667,33 @@ static void ZEND_FASTCALL zend_jit_fetch_dim_is_helper(zend_array *ht, zval *dim
650667 }
651668 ZEND_FALLTHROUGH ;
652669 case IS_NULL :
653- retval = zend_hash_find (ht , ZSTR_EMPTY_ALLOC ());
654- if (!retval ) {
655- ZVAL_NULL (result );
656- } else {
657- ZVAL_COPY_DEREF (result , retval );
670+ /* The array may be destroyed while throwing the notice.
671+ * Temporarily increase the refcount to detect this situation. */
672+ if (!(GC_FLAGS (ht ) & IS_ARRAY_IMMUTABLE )) {
673+ GC_ADDREF (ht );
658674 }
659-
675+ execute_data = EG (current_execute_data );
676+ opline = EX (opline );
660677 zend_error (E_DEPRECATED , "Using null as an array offset is deprecated, use an empty string instead" );
661-
662- return ;
678+ if (!(GC_FLAGS (ht ) & IS_ARRAY_IMMUTABLE ) && !GC_DELREF (ht )) {
679+ zend_array_destroy (ht );
680+ if (opline -> result_type & (IS_VAR | IS_TMP_VAR )) {
681+ if (EG (exception )) {
682+ ZVAL_UNDEF (EX_VAR (opline -> result .var ));
683+ } else {
684+ ZVAL_NULL (EX_VAR (opline -> result .var ));
685+ }
686+ }
687+ return ;
688+ }
689+ if (EG (exception )) {
690+ if (opline -> result_type & (IS_VAR | IS_TMP_VAR )) {
691+ ZVAL_UNDEF (EX_VAR (opline -> result .var ));
692+ }
693+ return ;
694+ }
695+ offset_key = ZSTR_EMPTY_ALLOC ();
696+ goto str_index ;
663697 case IS_DOUBLE :
664698 hval = zend_dval_to_lval (Z_DVAL_P (dim ));
665699 if (!zend_is_long_compatible (Z_DVAL_P (dim ), hval )) {
@@ -785,17 +819,22 @@ static int ZEND_FASTCALL zend_jit_fetch_dim_isset_helper(zend_array *ht, zval *d
785819 return 0 ;
786820 }
787821 ZEND_FALLTHROUGH ;
788- case IS_NULL : {
789- int result = 0 ;
790- retval = zend_hash_find ( ht , ZSTR_EMPTY_ALLOC ());
791- if (retval ) {
792- result = Z_TYPE_P ( retval ) > IS_NULL ;
822+ case IS_NULL :
823+ /* The array may be destroyed while throwing the notice.
824+ * Temporarily increase the refcount to detect this situation. */
825+ if (!( GC_FLAGS ( ht ) & IS_ARRAY_IMMUTABLE ) ) {
826+ GC_ADDREF ( ht ) ;
793827 }
794-
795828 zend_error (E_DEPRECATED , "Using null as an array offset is deprecated, use an empty string instead" );
796-
797- return result ;
798- }
829+ if (!(GC_FLAGS (ht ) & IS_ARRAY_IMMUTABLE ) && !GC_DELREF (ht )) {
830+ zend_array_destroy (ht );
831+ return 0 ;
832+ }
833+ if (EG (exception )) {
834+ return 0 ;
835+ }
836+ offset_key = ZSTR_EMPTY_ALLOC ();
837+ goto str_index ;
799838 case IS_DOUBLE :
800839 hval = zend_dval_to_lval (Z_DVAL_P (dim ));
801840 if (!zend_is_long_compatible (Z_DVAL_P (dim ), hval )) {
0 commit comments