Skip to content

Fix GH-20875: Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies#7

Closed
iliaal wants to merge 1 commit intomasterfrom
fix/gh-20875-lazy-proxy-guard-propagation
Closed

Fix GH-20875: Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies#7
iliaal wants to merge 1 commit intomasterfrom
fix/gh-20875-lazy-proxy-guard-propagation

Conversation

@iliaal
Copy link
Owner

@iliaal iliaal commented Mar 17, 2026

Summary

  • zend_std_get_property_ptr_ptr() was the only property handler that did not propagate the IN_GET guard to the underlying object when forwarding from a lazy proxy after initialization
  • Without the guard, __get is called on the underlying object when it shouldn't be, causing assertion failures (_get_zval_ptr_tmp, _zendi_try_convert_scalar_to_number, ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER)
  • The same guard-copying pattern already existed in read_property, write_property, unset_property, and has_property since commit 26f5009 (Fix lazy proxy calling magic methods twice php/php-src#18039)

Fixes php#20875, php#20873, php#20854.

…azy proxies

zend_std_get_property_ptr_ptr() was the only property handler that did
not propagate the IN_GET guard to the underlying object when forwarding
from a lazy proxy after initialization. This caused __get to be called
on the underlying object when it shouldn't be, leading to assertion
failures.

The same guard-copying pattern already existed in read_property,
write_property, unset_property, and has_property since commit
26f5009 (phpGH-18039).

Also fixes phpGH-20873 and phpGH-20854.

Closes phpGH-20875
@iliaal
Copy link
Owner Author

iliaal commented Mar 17, 2026

Submitted upstream as php#21463

@iliaal iliaal closed this Mar 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Assertion failure in _get_zval_ptr_tmp with lazy proxy

1 participant