Fixed incorrect usage of QM_ASSIGN instruction

Author: dstogov

NEWS

@@ -3,6 +3,9 @@ PHP                                                                        NEWS
 ?? ??? ????, PHP 7.4.0RC2
 
 - Core:
+  . Fixed incorrect usage of QM_ASSIGN instruction. It must not return IS_VAR.
+    As a side effect this allowed passign left hean list() "by reference",
+    instead of compile-time error. (Dmitry)
   . Fixed bug #78531 (Crash when using undefined variable as object). (Dmitry)
 
 - FFI:

Zend/tests/bug73663.phpt

@@ -20,12 +20,8 @@ var_dump($array);
 $array = [1];
 $func(list(&$val) = $array);
 var_dump($array);
-
-$array = [1];
-change(list($val) = $array);
-var_dump($array);
 ?>
---EXPECTF--
+--EXPECT--
 array(1) {
   [0]=>
   int(1)
@@ -74,9 +70,3 @@ array(10) {
   [9]=>
   int(10)
 }
-
-Notice: Only variables should be passed by reference in %s on line %d
-array(1) {
-  [0]=>
-  int(1)
-}

Zend/tests/bug73663_2.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #73663.2 ("Invalid opcode 65/16/8" occurs with a variable created with list())
+--FILE--
+<?php
+function change(&$ref) {
+	$ref = range(1, 10);
+	return;
+}
+
+$array = [1];
+change(list($val) = $array);
+var_dump($array);
+?>
+--EXPECTF--
+Fatal error: Only variables can be passed by reference in %s on line %d

Zend/zend_compile.c

@@ -2761,7 +2761,7 @@ void zend_compile_assign(znode *result, zend_ast *ast) /* {{{ */
 				if (zend_try_compile_cv(&cv_node, expr_ast) == FAILURE) {
 					zend_compile_simple_var_no_cv(&expr_node, expr_ast, BP_VAR_R, 0);
 				} else {
-					zend_emit_op(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
+					zend_emit_op_tmp(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
 				}
 			} else {
 				zend_compile_expr(&expr_node, expr_ast);
@@ -2801,7 +2801,7 @@ void zend_compile_assign(znode *result, zend_ast *ast) /* {{{ */
 					if (zend_try_compile_cv(&cv_node, expr_ast) == FAILURE) {
 						zend_compile_simple_var_no_cv(&expr_node, expr_ast, BP_VAR_R, 0);
 					} else {
-						zend_emit_op(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
+						zend_emit_op_tmp(&expr_node, ZEND_QM_ASSIGN, &cv_node, NULL);
 					}
 				} else {
 					zend_compile_expr(&expr_node, expr_ast);