Skip to content

Fix GH-20875: Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies#21463

Open
iliaal wants to merge 1 commit intophp:masterfrom
iliaal:fix/gh-20875-lazy-proxy-guard-propagation
Open

Fix GH-20875: Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies#21463
iliaal wants to merge 1 commit intophp:masterfrom
iliaal:fix/gh-20875-lazy-proxy-guard-propagation

Conversation

@iliaal
Copy link
Contributor

@iliaal iliaal commented Mar 17, 2026

Summary

  • zend_std_get_property_ptr_ptr() was the only property handler that did not propagate the IN_GET guard to the underlying object when forwarding from a lazy proxy after initialization
  • Without the guard, __get is called on the underlying object when it shouldn't be, causing assertion failures (_get_zval_ptr_tmp, _zendi_try_convert_scalar_to_number, ZEND_RETURN_BY_REF_SPEC_VAR_HANDLER)
  • The same guard-copying pattern already existed in read_property, write_property, unset_property, and has_property since commit 26f5009 (Fix lazy proxy calling magic methods twice #18039)

Fixes #20875, #20873, #20854.

…azy proxies

zend_std_get_property_ptr_ptr() was the only property handler that did
not propagate the IN_GET guard to the underlying object when forwarding
from a lazy proxy after initialization. This caused __get to be called
on the underlying object when it shouldn't be, leading to assertion
failures.

The same guard-copying pattern already existed in read_property,
write_property, unset_property, and has_property since commit
26f5009 (phpGH-18039).

Also fixes phpGH-20873 and phpGH-20854.

Closes phpGH-20875
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Assertion failure in _get_zval_ptr_tmp with lazy proxy

1 participant