From e5be08087755dcd32c7119dc2ff85aa2cbc76248 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Wed, 18 Mar 2020 16:12:43 +0100
Subject: [PATCH 1/3] Fix #79393: Null coalescing operator failing with
 SplFixedArray
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We favor the KISS principle over optimization[1] – SPL is already
special enough.

[1] <https://github.com/php/php-src/pull/2489/commits/352f3d4476a79bb86136b431719df7394e5a8d4e#r112498098>ff
---
 ext/spl/spl_fixedarray.c    | 16 +++-------------
 ext/spl/tests/bug79393.phpt | 16 ++++++++++++++++
 2 files changed, 19 insertions(+), 13 deletions(-)
 create mode 100644 ext/spl/tests/bug79393.phpt

diff --git a/ext/spl/spl_fixedarray.c b/ext/spl/spl_fixedarray.c
index 392175f781fc7..873390b25b6b4 100644
--- a/ext/spl/spl_fixedarray.c
+++ b/ext/spl/spl_fixedarray.c
@@ -342,19 +342,9 @@ static zval *spl_fixedarray_object_read_dimension(zval *object, zval *offset, in
 
 	intern = Z_SPLFIXEDARRAY_P(object);
 
-	if (type == BP_VAR_IS && intern->fptr_offset_has) {
-		SEPARATE_ARG_IF_REF(offset);
-		zend_call_method_with_1_params(object, intern->std.ce, &intern->fptr_offset_has, "offsetexists", rv, offset);
-		if (UNEXPECTED(Z_ISUNDEF_P(rv))) {
-			zval_ptr_dtor(offset);
-			return NULL;
-		}
-		if (!i_zend_is_true(rv)) {
-			zval_ptr_dtor(offset);
-			zval_ptr_dtor(rv);
-			return &EG(uninitialized_zval);
-		}
-		zval_ptr_dtor(rv);
+	if (type == BP_VAR_IS && !spl_fixedarray_object_has_dimension(object, offset, 1)) {
+		ZVAL_UNDEF(rv);
+		return &EG(uninitialized_zval);
 	}
 
 	if (intern->fptr_offset_get) {
diff --git a/ext/spl/tests/bug79393.phpt b/ext/spl/tests/bug79393.phpt
new file mode 100644
index 0000000000000..f8a2804c404fa
--- /dev/null
+++ b/ext/spl/tests/bug79393.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #79393 (Null coalescing operator failing with SplFixedArray)
+--FILE--
+<?php
+$foo = new SplFixedArray(2);
+$foo[0] = 'bar1';
+$foo[1] = 'bar2';
+
+var_dump($foo[0] ?? null);
+var_dump($foo[1] ?? null);
+var_dump($foo[2] ?? null);
+?>
+--EXPECT--
+string(4) "bar1"
+string(4) "bar2"
+NULL

From 1e8f5ae3400a1f90607818e0212fe40605edc983 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Wed, 18 Mar 2020 16:48:22 +0100
Subject: [PATCH 2/3] Don't check for falsy values here

We also remove the superfluous `rv` assignment.
---
 ext/spl/spl_fixedarray.c    |  3 +--
 ext/spl/tests/bug79393.phpt | 11 ++++++++++-
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/ext/spl/spl_fixedarray.c b/ext/spl/spl_fixedarray.c
index 873390b25b6b4..49bc69906ecb8 100644
--- a/ext/spl/spl_fixedarray.c
+++ b/ext/spl/spl_fixedarray.c
@@ -342,8 +342,7 @@ static zval *spl_fixedarray_object_read_dimension(zval *object, zval *offset, in
 
 	intern = Z_SPLFIXEDARRAY_P(object);
 
-	if (type == BP_VAR_IS && !spl_fixedarray_object_has_dimension(object, offset, 1)) {
-		ZVAL_UNDEF(rv);
+	if (type == BP_VAR_IS && !spl_fixedarray_object_has_dimension(object, offset, 0)) {
 		return &EG(uninitialized_zval);
 	}
 
diff --git a/ext/spl/tests/bug79393.phpt b/ext/spl/tests/bug79393.phpt
index f8a2804c404fa..e8036c70a0705 100644
--- a/ext/spl/tests/bug79393.phpt
+++ b/ext/spl/tests/bug79393.phpt
@@ -2,15 +2,24 @@
 Bug #79393 (Null coalescing operator failing with SplFixedArray)
 --FILE--
 <?php
-$foo = new SplFixedArray(2);
+$foo = new SplFixedArray(5);
 $foo[0] = 'bar1';
 $foo[1] = 'bar2';
+$foo[2] = 0;
+$foo[3] = false;
+$foo[4] = '';
 
 var_dump($foo[0] ?? null);
 var_dump($foo[1] ?? null);
 var_dump($foo[2] ?? null);
+var_dump($foo[3] ?? null);
+var_dump($foo[4] ?? null);
+var_dump($foo[5] ?? null);
 ?>
 --EXPECT--
 string(4) "bar1"
 string(4) "bar2"
+int(0)
+bool(false)
+string(0) ""
 NULL

From 3bcca83204fe4b309517f2cbdb8dc0177b34b8b4 Mon Sep 17 00:00:00 2001
From: "Christoph M. Becker" <cmbecker69@gmx.de>
Date: Wed, 18 Mar 2020 17:39:27 +0100
Subject: [PATCH 3/3] Add missing forward declaration

---
 ext/spl/spl_fixedarray.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ext/spl/spl_fixedarray.c b/ext/spl/spl_fixedarray.c
index 49bc69906ecb8..488731aa1fae0 100644
--- a/ext/spl/spl_fixedarray.c
+++ b/ext/spl/spl_fixedarray.c
@@ -336,6 +336,8 @@ static inline zval *spl_fixedarray_object_read_dimension_helper(spl_fixedarray_o
 }
 /* }}} */
 
+static int spl_fixedarray_object_has_dimension(zval *object, zval *offset, int check_empty);
+
 static zval *spl_fixedarray_object_read_dimension(zval *object, zval *offset, int type, zval *rv) /* {{{ */
 {
 	spl_fixedarray_object *intern;