Edit report at https://bugs.php.net/bug.php?id=62987&edit=1
ID: 62987 Comment by: reeze dot xia at gmail dot com Reported by: danko at very dot lv Summary: Assigning to ArrayObject[null][something] overrides all undefined variables Status: Open Type: Bug Package: SPL related Operating System: Linux PHP Version: 5.4Git-2012-08-31 (Git) Block user comment: N Private report: N New Comment: Hi, I'v send a PR to fix this: https://github.com/php/php-src/pull/181 Previous Comments: ------------------------------------------------------------------------ [2012-08-31 21:20:50] danko at very dot lv Forget about arrays. It just dawned on me that *everything undefined* is affected. var_dump($nothing); var_dump($a->nothing); string(6) "srsly?" string(6) "srsly?" ------------------------------------------------------------------------ [2012-08-31 21:05:35] danko at very dot lv A bit different behavior shows in older versions. See http://codepad.org/RBPih545 for example (don't know their version, but older than 5.4, obviously) ------------------------------------------------------------------------ [2012-08-31 20:57:44] danko at very dot lv Description: ------------ Basically, when you try to assign anything to ArrayObject[null]['any_key'], it fails as it should, but since that moment anytime you access a non-existing key in any array, you get the last created zval, or so it seems. Strangely enough, all warnings and notices are shown and isset() returns false. Test script: --------------- <? $a = new ArrayObject(); $b = []; $a[null]['hurr'] = 'durr'; var_dump($a['epic_magic']); var_dump($b['epic_magic']); var_dump($c['epic_magic']); // Undefined var!! $d = []; var_dump($a['epic_magic']); // more magic! var_dump($d['epic_magic']); $e = 'srsly?'; var_dump($a['epic_magic']); // srsly. Expected result: ---------------- Warning: Illegal offset type in /home/virtuall/epic.php on line 7 NULL NULL NULL NULL NULL NULL bool(false) Actual result: -------------- Warning: Illegal offset type in /home/virtuall/epic.php on line 7 array(1) { ["hurr"]=> string(4) "durr" } array(1) { ["hurr"]=> string(4) "durr" } array(1) { ["hurr"]=> string(4) "durr" } array(0) { } array(0) { } string(6) "srsly?" bool(false) ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=62987&edit=1