Changing the properties of a DateInterval through dynamic properties triggers a SegFault

[orose-assetgo]

Description

The following code:

<?php
$di = new \DateInterval('P0Y');
$field = 'd';
$i = 1;
$di->$field += $i;
var_dump($di);

Resulted in this output:

Process finished with exit code 139 (interrupted by signal 11:SIGSEGV)

But I expected this output instead:

object(DateInterval)#1 (10) {
  ["y"]=>
  int(0)
  ["m"]=>
  int(0)
  ["d"]=>
  int(1)
  ["h"]=>
  int(0)
  ["i"]=>
  int(0)
  ["s"]=>
  int(0)
  ["f"]=>
  float(0)
  ["invert"]=>
  int(0)
  ["days"]=>
  bool(false)
  ["from_string"]=>
  bool(false)
}

3v4l Link: https://3v4l.org/plDlt#v8.3.20
8.3.19 doesn't exhibit this issue, and nor does 8.4.6 and 8.2.28.

Swapping the variable variable for a switch doesn't trigger the same issue.

PHP Version

PHP 8.3.20 (cli) (built: Apr 10 2025 21:33:50) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.20, Copyright (c) Zend Technologies
with Zend OPcache v8.3.20, Copyright (c), by Zend Technologies
with Xdebug v3.4.2, Copyright (c) 2002-2025, by Derick Rethans

Operating System

Ubuntu 24.04.2

[27pchrisl]

My backtrace pointed to date_interval_get_property_ptr_ptr, git bisecting for the error narrowed it down to ce8ab5f - problem in ce8ab5f#diff-975ac482adc74b487c6ac9d8dde32153e4b8a803ef8ec41e8d6594f0a042db69R4402 ?

Removing that line clears the error, but I don't know enough about the change to submit a fix - @nielsdos ?

[nielsdos]

@27pchrisl Just removing that line will reintroduce the bug that it was trying to solve. It's just missing the NULL check on cache_slot, as there is no cache slot for a dynamic access. I'll fix it up.
I'm surprised there was no test for this though.