Merge branch 'PHP-7.4'

Zend/tests/arg_unpack/nested_by_ref.phpt

@@ -1,22 +0,0 @@
---TEST--
-By-ref unpacking of a nested access
---FILE--
-<?php
-
-function inc(&$var) {
-    $var++;
-}
-
-$ary = [[1]];
-inc(...$ary[0]);
-var_dump($ary);
-
-?>
---EXPECT--
-array(1) {
-  [0]=>
-  array(1) {
-    [0]=>
-    int(2)
-  }
-}

Zend/tests/bug78356.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #78356: Array returned from ArrayAccess is incorrectly unpacked as argument
+--FILE--
+<?php
+$object = new class implements ArrayAccess {
+    public function offsetGet($offset)
+    {
+        return [1, 2];
+    }
+    public function offsetExists($offset)
+    {
+        return true;
+    }
+    public function offsetUnset($offset) {}
+    public function offsetSet($offset, $value) {}
+};
+var_dump(max(...$object[0]));
+?>
+--EXPECT--
+int(2)

Zend/zend_compile.c

@@ -2940,15 +2940,7 @@ uint32_t zend_compile_args(zend_ast *ast, zend_function *fbc) /* {{{ */
 			uses_arg_unpack = 1;
 			fbc = NULL;
 
-			/* Unpacking may need to create interior references in the unpacked array,
-			 * but apart from that does not have any other reference semantics: It should
-			 * generate a notice if the variable does not exist and it should not convert
-			 * the variable itself into a reference. As such, use an RW fetch. */
-			if (zend_is_variable(arg->child[0])) {
-				zend_compile_var(&arg_node, arg->child[0], BP_VAR_RW, 0);
-			} else {
-				zend_compile_expr(&arg_node, arg->child[0]);
-			}
+			zend_compile_expr(&arg_node, arg->child[0]);
 			opline = zend_emit_op(NULL, ZEND_SEND_UNPACK, &arg_node, NULL);
 			opline->op2.num = arg_count;
 			opline->result.var = (uint32_t)(zend_intptr_t)ZEND_CALL_ARG(NULL, arg_count);

Zend/zend_vm_def.h

@@ -4906,11 +4906,7 @@ ZEND_VM_HANDLER(165, ZEND_SEND_UNPACK, ANY, ANY)
 	int arg_num;
 
 	SAVE_OPLINE();
-	if (OP1_TYPE & (IS_VAR|IS_CV)) {
-		args = GET_OP1_ZVAL_PTR_PTR_UNDEF(BP_VAR_RW);
-	} else {
-		args = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
-	}
+	args = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
 	arg_num = ZEND_CALL_NUM_ARGS(EX(call)) + 1;
 
 ZEND_VM_C_LABEL(send_again):

Zend/zend_vm_execute.h

@@ -1837,11 +1837,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_SEND_UNPACK_SPEC_HANDLER(ZEND_
 	int arg_num;
 
 	SAVE_OPLINE();
-	if (opline->op1_type & (IS_VAR|IS_CV)) {
-		args = get_zval_ptr_ptr_undef(opline->op1_type, opline->op1, BP_VAR_RW);
-	} else {
-		args = get_zval_ptr_undef(opline->op1_type, opline->op1, BP_VAR_R);
-	}
+	args = get_zval_ptr_undef(opline->op1_type, opline->op1, BP_VAR_R);
 	arg_num = ZEND_CALL_NUM_ARGS(EX(call)) + 1;
 
 send_again:

ext/opcache/Optimizer/zend_inference.c

@@ -3437,7 +3437,6 @@ static int zend_update_type_info(const zend_op_array *op_array,
 							case ZEND_SEND_VAR_NO_REF:
 							case ZEND_SEND_VAR_NO_REF_EX:
 							case ZEND_SEND_REF:
-							case ZEND_SEND_UNPACK:
 							case ZEND_ASSIGN_REF:
 							case ZEND_YIELD:
 							case ZEND_INIT_ARRAY: