Using ArrayObject with ARRAY_AS_PROPS and by reference assignment

[andrew-demb]

Description

Reproducible in PHP 8.3.20. Cannot be reproduced in PHP 8.3.19

The following code:

<?php

$object = new \ArrayObject([], \ArrayObject::ARRAY_AS_PROPS);
$foo = 'websocket';
$object->{$foo} = new \ArrayObject([], \ArrayObject::ARRAY_AS_PROPS);
$object = &$object->{$foo};

echo 'success';

Resulted in this output:

Process finished with exit code 139 (interrupted by signal 11:SIGSEGV)

But I expected this output instead:

success

https://3v4l.org/5qSOS

PHP Version

PHP 8.3.20 (cli) (built: Apr 14 2025 18:44:45) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.20, Copyright (c) Zend Technologies
with Zend OPcache v8.3.20, Copyright (c), by Zend Technologies
with Xdebug v3.4.2, Copyright (c) 2002-2025, by Derick Rethans

Operating System

Debian 11

[andrew-demb]

Refs: vanodevium/toml#4

[andrew-demb]

Here's the output of gdb

(gdb) run test.php
Starting program: /usr/bin/php test.php
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
spl_array_get_property_ptr_ptr (object=0x7ffff55facd8, name=0x7ffff555d500, type=1, cache_slot=0x0) at ./ext/spl/spl_array.c:849
849     ./ext/spl/spl_array.c: No such file or directory.

[andrew-demb]

Seems like this change led to the problem ce8ab5f#diff-f86ee648d398a68130b2bff8808bcdb6382278eb198f98c5f6e12cb1f051a23e (full diff between 8.3.19-8.3.20 php-8.3.19...php-8.3.20#diff-f86ee648d398a68130b2bff8808bcdb6382278eb198f98c5f6e12cb1f051a23e)

[Girgias]

@nielsdos can you have a look?

[nielsdos]

Sorry for the trouble, this is already fixed for the upcoming 8.3.21 release.