Delay freeing of garbage for write_property

Author: iluuu1994

Zend/tests/gh10168/assign_prop.phpt

@@ -1,6 +1,5 @@
 --TEST--
 GH-10168: Assign prop
---XFAIL--
 --FILE--
 <?php
 

Zend/tests/gh10168/assign_prop_ref.phpt

@@ -1,6 +1,5 @@
 --TEST--
 GH-10168: Assign prop ref
---XFAIL--
 --FILE--
 <?php
 

Zend/tests/gh10168/assign_prop_ref_with_prop_ref.phpt

@@ -1,6 +1,5 @@
 --TEST--
 GH-10168: Assign prop ref with prop ref
---XFAIL--
 --FILE--
 <?php
 

Zend/tests/gh10168/assign_prop_with_prop_ref.phpt

@@ -1,6 +1,5 @@
 --TEST--
 GH-10168: Assign prop with prop ref
---XFAIL--
 --FILE--
 <?php
 

Zend/tests/gh10168/assign_untyped_prop.phpt

@@ -1,6 +1,5 @@
 --TEST--
 GH-10168: Assign prop
---XFAIL--
 --FILE--
 <?php
 

Zend/tests/gh10168/assign_untyped_prop_ref.phpt

@@ -1,6 +1,5 @@
 --TEST--
 GH-10168: Assign prop ref
---XFAIL--
 --FILE--
 <?php
 

Zend/tests/gh10168/assign_untyped_prop_ref_with_prop_ref.phpt

@@ -1,6 +1,5 @@
 --TEST--
 GH-10168: Assign prop ref with prop ref
---XFAIL--
 --FILE--
 <?php
 

Zend/tests/gh10168/assign_untyped_prop_with_prop_ref.phpt

@@ -1,6 +1,5 @@
 --TEST--
 GH-10168: Assign prop with prop ref
---XFAIL--
 --FILE--
 <?php
 

Zend/zend_execute_API.c

@@ -196,6 +196,9 @@ void init_executor(void) /* {{{ */
 	EG(filename_override) = NULL;
 	EG(lineno_override) = -1;
 
+	EG(delay_assignment_garbage) = false;
+	EG(delayed_assignment_garbage) = NULL;
+
 	zend_fiber_init();
 	zend_weakrefs_init();
 

Zend/zend_globals.h

@@ -287,6 +287,9 @@ struct _zend_executor_globals {
 	zend_ulong reserved_stack_size;
 #endif
 
+	bool delay_assignment_garbage;
+	zend_refcounted *delayed_assignment_garbage;
+
 	void *reserved[ZEND_MAX_RESERVED_RESOURCES];
 };
 

Zend/zend_object_handlers.c

@@ -836,9 +836,22 @@ ZEND_API zval *zend_std_write_property(zend_object *zobj, zend_string *name, zva
 				value = &tmp;
 			}
 
-found:
-			variable_ptr = zend_assign_to_variable(
-				variable_ptr, value, IS_TMP_VAR, property_uses_strict_types());
+found:;
+			zend_refcounted *garbage = NULL;
+			variable_ptr = zend_assign_to_variable_ex(
+				variable_ptr, value, IS_TMP_VAR, property_uses_strict_types(), &garbage);
+			if (garbage) {
+				if (EG(delay_assignment_garbage)) {
+					EG(delay_assignment_garbage) = false;
+					EG(delayed_assignment_garbage) = garbage;
+				} else {
+					if (GC_DELREF(garbage) == 0) {
+						rc_dtor_func(garbage);
+					} else {
+						gc_check_possible_root_no_ref(garbage);
+					}
+				}
+			}
 			goto exit;
 		}
 		if (Z_PROP_FLAG_P(variable_ptr) == IS_PROP_UNINIT) {

Zend/zend_vm_def.h

@@ -2487,7 +2487,16 @@ ZEND_VM_C_LABEL(fast_assign_obj):
 		ZVAL_DEREF(value);
 	}
 
+	bool previous_delay_assignment_garbage = EG(delay_assignment_garbage);
+	zend_refcounted *previous_delayed_assignment_garbage = EG(delayed_assignment_garbage);
+	EG(delay_assignment_garbage) = true;
+	EG(delayed_assignment_garbage) = NULL;
 	value = zobj->handlers->write_property(zobj, name, value, (OP2_TYPE == IS_CONST) ? CACHE_ADDR(opline->extended_value) : NULL);
+	if (EG(delayed_assignment_garbage)) {
+		garbage = EG(delayed_assignment_garbage);
+	}
+	EG(delay_assignment_garbage) = previous_delay_assignment_garbage;
+	EG(delayed_assignment_garbage) = previous_delayed_assignment_garbage;
 
 	if (OP2_TYPE != IS_CONST) {
 		zend_tmp_string_release(tmp_name);