Stdlib: settype() uninitialized typed property by-ref — Error not LogicException (#13884)

ext/standard/VmSettype.php

@@ -12,6 +12,7 @@
 use PHPCompiler\VM\ObjectEntry;
 use PHPCompiler\VM\ResourceSupport;
 use PHPCompiler\VM\TypeCheck;
+use PHPCompiler\VM\TypedPropertyCheck;
 use PHPCompiler\VM\Variable;
 
 /**
@@ -21,6 +22,7 @@ final class VmSettype
 {
     public static function apply(Variable $slot, string $typeName, ?Frame $frame = null): void
     {
+        TypedPropertyCheck::assertWritableByReference($slot);
         $type = strtolower($typeName);
         $value = $slot->resolveIndirect();
         $result = new Variable();

lib/VM/TypedPropertyCheck.php

@@ -99,6 +99,51 @@ public static function assertReadable(Variable $var): void
         throw new TypedPropertyReadSignal($vm->makeEngineError(self::errorMessage($var)));
     }
 
+    /**
+     * Zend by-reference write to uninitialized non-nullable typed property (zend_types.c, type.c).
+     */
+    public static function assertWritableByReference(Variable $var): void
+    {
+        if (!self::isUninitialized($var)) {
+            return;
+        }
+        if (self::propertyAllowsNull($var)) {
+            return;
+        }
+        $vm = \PHPCompiler\VM::running();
+        $message = self::writableByReferenceErrorMessage($var);
+        if (null === $vm) {
+            throw new \Error($message);
+        }
+        throw new TypedPropertyReadSignal($vm->makeEngineError($message));
+    }
+
+    public static function writableByReferenceErrorMessage(Variable $var): string
+    {
+        $target = $var->resolveIndirect();
+        $name = $target->objectPropertyName ?? 'property';
+        if (null !== $target->staticPropertyClassLc) {
+            $classLabel = $target->staticPropertyClassLc;
+            $vm = \PHPCompiler\VM::running();
+            if (null !== $vm && isset($vm->context->classes[$target->staticPropertyClassLc])) {
+                $classLabel = $vm->context->classes[$target->staticPropertyClassLc]->name;
+            }
+
+            return sprintf(
+                'Cannot access uninitialized non-nullable property %s::$%s by reference',
+                $classLabel,
+                $name
+            );
+        }
+        $owner = $target->objectPropertyOwner;
+
+        return sprintf(
+            'Cannot access uninitialized non-nullable property %s::$%s by reference',
+            $owner->class->name,
+            $name
+        );
+    }
+
     /**
      * Nullable typed property (`?T`, `T|null`, `mixed`) — Zend nullsafe short-circuit (#5220).
      */

test/compliance/cases/stdlib/settype_uninit_typed_byref.phpt

@@ -0,0 +1,16 @@
+--TEST--
+stdlib settype() — uninitialized non-nullable typed property by-ref throws Error (#13884, ext/standard/type.c)
+--FILE--
+<?php
+class C {
+    public int $x;
+}
+$c = new C;
+try {
+    settype($c->x, 'int');
+    echo "no throw\n";
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+--EXPECT--
+Cannot access uninitialized non-nullable property C::$x by reference

test/repro/maintainer_gap_settype_uninitialized_typed.php

@@ -0,0 +1,14 @@
+<?php
+
+class C {
+    public int $x;
+}
+
+$c = new C();
+try {
+    settype($c->x, 'int');
+    echo "no throw\n";
+    exit(1);
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}