- Fix issues with __get() returning arrays (might need to be revised)

Zend/zend_exceptions.c

@@ -538,7 +538,7 @@ ZEND_METHOD(exception, getTraceAsString)
 	char *res = estrdup(""), **str = &res, *s_tmp;
 	int res_len = 0, *len = &res_len, num = 0;
 
-	trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
+	trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, BP_VAR_R TSRMLS_CC);
 	zend_hash_apply_with_arguments(Z_ARRVAL_P(trace), (apply_func_args_t)_build_trace_string, 3, str, len, &num);
 
 	s_tmp = emalloc(1 + MAX_LENGTH_OF_LONG + 7 + 1);

Zend/zend_execute.c

@@ -919,7 +919,7 @@ static inline HashTable *zend_get_target_symbol_table(zend_op *opline, temp_vari
 
 static inline zval **zend_fetch_dimension_address_inner(HashTable *ht, zval *dim, int type TSRMLS_DC)
 {
-	zval **retval;
+	zval **retval, dim_copy;
 	zstr offset_key;
 	int offset_key_length;
 	zend_uchar ztype = Z_TYPE_P(dim);
@@ -931,6 +931,7 @@ static inline zval **zend_fetch_dimension_address_inner(HashTable *ht, zval *dim
 			offset_key.s = "";
 			offset_key_length = 1;
 			goto fetch_string_dim;
+
 		case IS_STRING:
 		case IS_UNICODE:
 
@@ -1272,7 +1273,7 @@ static void zend_fetch_property_address(temp_variable *result, zval **container_
 			zval *ptr;
 
 			if (Z_OBJ_HT_P(container)->read_property &&
-				(ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, BP_VAR_W TSRMLS_CC)) != NULL) {
+				(ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, type TSRMLS_CC)) != NULL) {
 				if (result) {
 					result->var.ptr = ptr;
 					result->var.ptr_ptr = &result->var.ptr;
@@ -1285,7 +1286,7 @@ static void zend_fetch_property_address(temp_variable *result, zval **container_
 		}
 	} else if (Z_OBJ_HT_P(container)->read_property) {
 		if (result) {
-			result->var.ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, BP_VAR_W TSRMLS_CC);
+			result->var.ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, type TSRMLS_CC);
 			result->var.ptr_ptr = &result->var.ptr;
 		}
 	} else {

Zend/zend_object_handlers.c

@@ -357,6 +357,9 @@ zval *zend_std_read_property(zval *object, zval *member, int type TSRMLS_DC)
 		zval_ptr_dtor(&tmp_member);
 		(*retval)->refcount--;
 	}
+	if (*retval && (type == BP_VAR_W || type == BP_VAR_RW) && Z_TYPE_PP(retval) == IS_ARRAY) {
+		zend_error(E_ERROR, "Cannot use array returned from %v::__get('%R') in write context", zobj->ce->name, Z_TYPE_P(member), Z_STRVAL_P(member));
+	}
 	return *retval;
 }