Fix bug #68188

NEWS

@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2014, PHP 5.5.19
 
+- Core:
+  . Fixed bug #68188 ($a->foo .= 'test'; can leave $a->foo undefined). (Nikita)
+
 
 ?? ??? 2014, PHP 5.5.18
 

Zend/tests/bug68118.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #68118: $a->foo .= 'test'; can leave $a->foo undefined
+--FILE--
+<?php
+
+set_error_handler(function() {
+    $obj = new stdClass;
+    $obj->test = 'meow';
+    return true;
+});
+ 
+$a = new stdClass;
+$a->undefined .= 'test';
+var_dump($a);
+
+?>
+--EXPECT--
+object(stdClass)#2 (1) {
+  ["undefined"]=>
+  string(4) "test"
+}

Zend/zend_object_handlers.c

@@ -754,9 +754,6 @@ static zval **zend_std_get_property_ptr_ptr(zval *object, zval *member, int type
 			/* we don't have access controls - will just add it */
 			new_zval = &EG(uninitialized_zval);
 
-			if(UNEXPECTED(type == BP_VAR_RW || type == BP_VAR_R)) {
-				zend_error(E_NOTICE, "Undefined property: %s::$%s", zobj->ce->name, Z_STRVAL_P(member));
-			}
 			Z_ADDREF_P(new_zval);
 			if (EXPECTED((property_info->flags & ZEND_ACC_STATIC) == 0) &&
 			    property_info->offset >= 0) {
@@ -776,6 +773,12 @@ static zval **zend_std_get_property_ptr_ptr(zval *object, zval *member, int type
 				}
 				zend_hash_quick_update(zobj->properties, property_info->name, property_info->name_length+1, property_info->h, &new_zval, sizeof(zval *), (void **) &retval);
 			}
+
+			/* Notice is thrown after creation of the property, to avoid EG(std_property_info)
+			 * being overwritten in an error handler. */
+			if (UNEXPECTED(type == BP_VAR_RW || type == BP_VAR_R)) {
+				zend_error(E_NOTICE, "Undefined property: %s::$%s", zobj->ce->name, Z_STRVAL_P(member));
+			}
 		} else {
 			/* we do have getter - fail and let it try again with usual get/set */
 			retval = NULL;