Merge branch 'PHP-7.1' into PHP-7.2

* PHP-7.1:
  Fixed bug #76534 (PHP hangs on 'illegal string offset on string references with an error handler)

Conflicts:
	Zend/zend_execute.c
	Zend/zend_vm_def.h
	Zend/zend_vm_execute.h

4 files changed, 47 insertions, 10 deletions

diff --git a/Zend/tests/bug76534.phpt b/Zend/tests/bug76534.phpt
new file mode 100644
index 0000000000..956a29ba2c
--- /dev/null
+++ b/Zend/tests/bug76534.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #76534 (PHP hangs on 'illegal string offset on string references with an error handler)
+--FILE--
+<?php
+set_error_handler(function ($severity, $message, $file, $line) {
+	throw new \Exception($message);
+});
+
+$x = "foo";
+$y = &$x["bar"];
+?>
+--EXPECTF--
+Fatal error: Uncaught Exception: Illegal string offset 'bar' in %sbug76534.php:%d
+Stack trace:
+#0 %sbug76534.php(%d): {closure}(2, 'Illegal string ...', '%s', %d, Array)
+#1 {main}
+  thrown in %sbug76534.php on line %d
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 8a9ddb2d8d..3edbb9c7d6 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1651,7 +1651,9 @@ fetch_from_array:
 			zend_throw_error(NULL, "[] operator not supported for strings");
 		} else {
 			zend_check_string_offset(dim, type EXECUTE_DATA_CC);
-			zend_wrong_string_offset(EXECUTE_DATA_C);
+			if (EXPECTED(EG(exception) == NULL)) {
+				zend_wrong_string_offset(EXECUTE_DATA_C);
+			}
 		}
 		ZVAL_ERROR(result);
 	} else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 7eb91efe8b..4c104b8e61 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -916,7 +916,9 @@ ZEND_VM_C_LABEL(assign_dim_op_convert_to_array):
 					zend_throw_error(NULL, "[] operator not supported for strings");
 				} else {
 					zend_check_string_offset(dim, BP_VAR_RW EXECUTE_DATA_CC);
-					zend_wrong_string_offset(EXECUTE_DATA_C);
+					if (EXPECTED(EG(exception) == NULL)) {
+						zend_wrong_string_offset(EXECUTE_DATA_C);
+					}
 				}
 				UNDEF_RESULT();
 			} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 82f8c4ef68..854268108b 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -17661,7 +17661,9 @@ assign_dim_op_convert_to_array:
 					zend_throw_error(NULL, "[] operator not supported for strings");
 				} else {
 					zend_check_string_offset(dim, BP_VAR_RW EXECUTE_DATA_CC);
-					zend_wrong_string_offset(EXECUTE_DATA_C);
+					if (EXPECTED(EG(exception) == NULL)) {
+						zend_wrong_string_offset(EXECUTE_DATA_C);
+					}
 				}
 				UNDEF_RESULT();
 			} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
@@ -20685,7 +20687,9 @@ assign_dim_op_convert_to_array:
 					zend_throw_error(NULL, "[] operator not supported for strings");
 				} else {
 					zend_check_string_offset(dim, BP_VAR_RW EXECUTE_DATA_CC);
-					zend_wrong_string_offset(EXECUTE_DATA_C);
+					if (EXPECTED(EG(exception) == NULL)) {
+						zend_wrong_string_offset(EXECUTE_DATA_C);
+					}
 				}
 				UNDEF_RESULT();
 			} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
@@ -21999,7 +22003,9 @@ assign_dim_op_convert_to_array:
 					zend_throw_error(NULL, "[] operator not supported for strings");
 				} else {
 					zend_check_string_offset(dim, BP_VAR_RW EXECUTE_DATA_CC);
-					zend_wrong_string_offset(EXECUTE_DATA_C);
+					if (EXPECTED(EG(exception) == NULL)) {
+						zend_wrong_string_offset(EXECUTE_DATA_C);
+					}
 				}
 				UNDEF_RESULT();
 			} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
@@ -24605,7 +24611,9 @@ assign_dim_op_convert_to_array:
 					zend_throw_error(NULL, "[] operator not supported for strings");
 				} else {
 					zend_check_string_offset(dim, BP_VAR_RW EXECUTE_DATA_CC);
-					zend_wrong_string_offset(EXECUTE_DATA_C);
+					if (EXPECTED(EG(exception) == NULL)) {
+						zend_wrong_string_offset(EXECUTE_DATA_C);
+					}
 				}
 				UNDEF_RESULT();
 			} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
@@ -35400,7 +35408,9 @@ assign_dim_op_convert_to_array:
 					zend_throw_error(NULL, "[] operator not supported for strings");
 				} else {
 					zend_check_string_offset(dim, BP_VAR_RW EXECUTE_DATA_CC);
-					zend_wrong_string_offset(EXECUTE_DATA_C);
+					if (EXPECTED(EG(exception) == NULL)) {
+						zend_wrong_string_offset(EXECUTE_DATA_C);
+					}
 				}
 				UNDEF_RESULT();
 			} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
@@ -39558,7 +39568,9 @@ assign_dim_op_convert_to_array:
 					zend_throw_error(NULL, "[] operator not supported for strings");
 				} else {
 					zend_check_string_offset(dim, BP_VAR_RW EXECUTE_DATA_CC);
-					zend_wrong_string_offset(EXECUTE_DATA_C);
+					if (EXPECTED(EG(exception) == NULL)) {
+						zend_wrong_string_offset(EXECUTE_DATA_C);
+					}
 				}
 				UNDEF_RESULT();
 			} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
@@ -41917,7 +41929,9 @@ assign_dim_op_convert_to_array:
 					zend_throw_error(NULL, "[] operator not supported for strings");
 				} else {
 					zend_check_string_offset(dim, BP_VAR_RW EXECUTE_DATA_CC);
-					zend_wrong_string_offset(EXECUTE_DATA_C);
+					if (EXPECTED(EG(exception) == NULL)) {
+						zend_wrong_string_offset(EXECUTE_DATA_C);
+					}
 				}
 				UNDEF_RESULT();
 			} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
@@ -45591,7 +45605,9 @@ assign_dim_op_convert_to_array:
 					zend_throw_error(NULL, "[] operator not supported for strings");
 				} else {
 					zend_check_string_offset(dim, BP_VAR_RW EXECUTE_DATA_CC);
-					zend_wrong_string_offset(EXECUTE_DATA_C);
+					if (EXPECTED(EG(exception) == NULL)) {
+						zend_wrong_string_offset(EXECUTE_DATA_C);
+					}
 				}
 				UNDEF_RESULT();
 			} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {