Fix const/cv freeing on failed reference assignment

2 files changed, 29 insertions, 1 deletions

diff --git a/Zend/tests/type_declarations/typed_properties_106.phpt b/Zend/tests/type_declarations/typed_properties_106.phpt
new file mode 100644
index 0000000000..344cfa5349
--- /dev/null
+++ b/Zend/tests/type_declarations/typed_properties_106.phpt
@@ -0,0 +1,26 @@
+--TEST--
+CONST/CV should not be freed on failed reference assignment
+--FILE--
+<?php
+class Test {
+    public ?Type $prop;
+}
+$obj = new Test;
+$ref =& $obj->prop;
+try {
+    $ref = [1];
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    $ary = [1];
+    $ref = $ary;
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+var_dump($ref);
+?>
+--EXPECT--
+Cannot assign array to reference held by property Test::$prop of type ?Type
+Cannot assign array to reference held by property Test::$prop of type ?Type
+NULL
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 3611c5b008..c1ff85bff8 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -3187,7 +3187,9 @@ ZEND_API zval* zend_assign_to_typed_ref(zval *variable_ptr, zval *value, zend_uc
 		Z_TRY_DELREF_P(value);
 	}
 	if (!ret) {
-		zval_ptr_dtor(value);
+		if (value_type & (IS_VAR|IS_TMP_VAR)) {
+			zval_ptr_dtor(value);
+		}
 		return Z_REFVAL_P(variable_ptr);
 	}