Fix another use-after-free with static properties/destructors

Zend/tests/gh10168_1.phpt

@@ -7,7 +7,7 @@ class Test
 {
     static $instances;
     public function __construct() {
-	    (self::$instances[NULL] = $this) > 0;
+	    var_dump(self::$instances[NULL] = $this);
 	    var_dump(self::$instances);
     }
 
@@ -19,14 +19,15 @@ new Test();
 new Test();
 
 ?>
---EXPECTF--
-Notice: Object of class Test could not be converted to int in %s on line %d
+--EXPECT--
+object(Test)#1 (0) {
+}
 array(1) {
   [""]=>
   object(Test)#1 (0) {
   }
 }
-
-Notice: Object of class Test could not be converted to int in %s on line %d
+object(Test)#2 (0) {
+}
 array(0) {
 }

Zend/tests/gh10168_10.phpt

@@ -0,0 +1,22 @@
+--TEST--
+GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign typed static prop ref
+--FILE--
+<?php
+
+class Test {
+    static ?Test $a = null;
+    function __construct() {
+        var_dump(self::$a = &$this);
+    }
+    function __destruct() {
+        self::$a = null;
+    }
+}
+new Test;
+new Test;
+
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+NULL

Zend/tests/gh10168_11.phpt

@@ -0,0 +1,21 @@
+--TEST--
+GH-10168 (heap-buffer-overflow at zval_undefined_cv): global by ref val error
+--FILE--
+<?php
+
+class Test {
+    function __destruct(){
+        unset($GLOBALS['a']);
+    }
+}
+
+function returnsVal() {
+    return 42;
+}
+$a = new Test;
+var_dump($a =& returnsVal());
+
+?>
+--EXPECTF--
+Notice: Only variables should be assigned by reference in %s on line %d
+int(42)

Zend/tests/gh10168_12.phpt

@@ -0,0 +1,22 @@
+--TEST--
+GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign static prop ref
+--FILE--
+<?php
+
+class Test {
+    static $a = null;
+    function __construct() {
+        var_dump(self::$a = &$this);
+    }
+    function __destruct() {
+        self::$a = null;
+    }
+}
+new Test;
+new Test;
+
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+NULL

Zend/tests/gh10168_13.phpt

@@ -0,0 +1,35 @@
+--TEST--
+GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign prop ref
+--FILE--
+<?php
+
+class Box {
+	public $storage;
+}
+
+$box = new Box();
+
+class Test
+{
+	public function __construct() {
+		global $box;
+		var_dump($box->storage = &$this);
+	}
+
+	function __destruct() {
+		global $box;
+		var_dump($box->storage);
+		$box->storage = null;
+	}
+}
+new Test();
+new Test();
+
+?>
+--EXPECT--
+object(Test)#2 (0) {
+}
+object(Test)#3 (0) {
+}
+NULL
+NULL

Zend/tests/gh10168_14.phpt

@@ -0,0 +1,35 @@
+--TEST--
+GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign typed prop ref
+--FILE--
+<?php
+
+class Box {
+	public ?Test $storage = null;
+}
+
+$box = new Box();
+
+class Test
+{
+	public function __construct() {
+		global $box;
+		var_dump($box->storage = &$this);
+	}
+
+	function __destruct() {
+		global $box;
+		var_dump($box->storage);
+		$box->storage = null;
+	}
+}
+new Test();
+new Test();
+
+?>
+--EXPECT--
+object(Test)#2 (0) {
+}
+object(Test)#3 (0) {
+}
+NULL
+NULL

Zend/tests/gh10168_15.phpt

@@ -0,0 +1,21 @@
+--TEST--
+GH-10168 (heap-buffer-overflow at zval_undefined_cv): global by ref
+--FILE--
+<?php
+
+class Test {
+    function __destruct(){
+        unset($GLOBALS['a']);
+    }
+}
+
+function &returnsVal() {
+    $a = 42;
+    return $a;
+}
+$a = new Test;
+var_dump($a =& returnsVal());
+
+?>
+--EXPECT--
+int(42)

Zend/tests/gh10168_2.phpt

@@ -8,7 +8,7 @@ $a = null;
 class Test
 {
 	public function __construct() {
-		($GLOBALS['a'] = $this) > 0;
+		var_dump($GLOBALS['a'] = $this);
 		// Destructor called after comparison, so a will be NULL
 		var_dump($GLOBALS['a']);
 	}
@@ -22,11 +22,12 @@ new Test();
 
 ?>
 --EXPECTF--
-Notice: Object of class Test could not be converted to int in %s on line %d
 object(Test)#1 (0) {
 }
-
-Notice: Object of class Test could not be converted to int in %s on line %d
+object(Test)#1 (0) {
+}
+object(Test)#2 (0) {
+}
 
 Warning: Undefined global variable $a in %s on line %d
 NULL

Zend/tests/gh10168_3.phpt

@@ -1,30 +1,36 @@
 --TEST--
-GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign typed prop
---XFAIL--
+GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign typed static prop
 --FILE--
 <?php
 class Test
 {
 	static ?Test $a = null;
 
 	public function __construct() {
-		if (self::$a === null) {
-			var_dump(self::$a = &$this);
+		static $i = 0;
+		$i++;
+		if ($i === 1) {
+			var_dump(self::$a = $this);
 		} else {
+			// Avoid cache slot, triggering write_property
 			var_dump(self::$a = $this);
 		}
 	}
 
 	function __destruct() {
+		var_dump(self::$a);
 		self::$a = null;
 	}
 }
 new Test();
 new Test();
 
 ?>
---EXPECTF--
+--EXPECT--
 object(Test)#1 (0) {
 }
 object(Test)#2 (0) {
 }
+object(Test)#2 (0) {
+}
+NULL

Zend/tests/gh10168_4.phpt

@@ -0,0 +1,36 @@
+--TEST--
+GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign prop
+--FILE--
+<?php
+
+class Box {
+	public $storage;
+}
+
+$box = new Box();
+
+class Test
+{
+	public function __construct() {
+		global $box;
+		var_dump($box->storage = $this);
+	}
+
+	function __destruct() {
+		global $box;
+		var_dump($box->storage);
+		$box->storage = null;
+	}
+}
+new Test();
+new Test();
+
+?>
+--EXPECT--
+object(Test)#2 (0) {
+}
+object(Test)#3 (0) {
+}
+object(Test)#3 (0) {
+}
+NULL

Zend/tests/gh10168_5.phpt

@@ -0,0 +1,32 @@
+--TEST--
+GH-10168 (heap-buffer-overflow at zval_undefined_cv): allocated assignment in destructor
+--FILE--
+<?php
+
+class Foo {}
+
+class Test
+{
+	static Test|Foo|null $a = null;
+
+	public function __construct() {
+		var_dump(self::$a = $this);
+	}
+
+	function __destruct() {
+		var_dump(self::$a = new Foo());
+	}
+}
+new Test();
+new Test();
+
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+object(Foo)#3 (0) {
+}
+object(Test)#2 (0) {
+}
+object(Foo)#1 (0) {
+}

Zend/tests/gh10168_6.phpt

@@ -0,0 +1,40 @@
+--TEST--
+GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign typed prop without cache slot
+--XFAIL--
+--FILE--
+<?php
+
+class Box {
+	public $storage;
+}
+
+$box = new Box();
+
+class Test
+{
+	public function __construct() {
+		static $i = 0;
+		$i++;
+		global $box;
+		if ($i === 1) {
+			var_dump($box->storage = $this);
+		} else {
+			// Avoid cache slot, triggering write_property
+			var_dump($box->storage = $this);
+		}
+	}
+
+	function __destruct() {
+		global $box;
+		$box->storage = null;
+	}
+}
+new Test();
+new Test();
+
+?>
+--EXPECT--
+object(Test)#2 (0) {
+}
+object(Test)#3 (0) {
+}

Zend/tests/gh10168_7.phpt

@@ -0,0 +1,29 @@
+--TEST--
+GH-10168 (heap-buffer-overflow at zval_undefined_cv): assign typed static prop by ref
+--FILE--
+<?php
+
+class Test
+{
+	static ?Test $a = null;
+
+	public function __construct() {
+		var_dump(self::$a = &$this);
+	}
+
+	function __destruct() {
+		var_dump(self::$a);
+		self::$a = null;
+	}
+}
+new Test();
+new Test();
+
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+object(Test)#2 (0) {
+}
+NULL
+NULL