Skip to content

Fix GH-21478: Forward read_property to real instance for initialized lazy proxies#9

Closed
iliaal wants to merge 1 commit intomasterfrom
fix/gh-21478-proxy-read-property-guard
Closed

Fix GH-21478: Forward read_property to real instance for initialized lazy proxies#9
iliaal wants to merge 1 commit intomasterfrom
fix/gh-21478-proxy-read-property-guard

Conversation

@iliaal
Copy link
Owner

@iliaal iliaal commented Mar 21, 2026

Summary

Fixes php#21478

zend_std_read_property() was calling __get/__isset on an initialized lazy proxy before forwarding to the real instance. This produced double magic method invocations when the real instance's __get accessed the proxy -- the proxy's own guard was clear, so __get fired on the proxy too.

For pure reads (BP_VAR_R, BP_VAR_IS), forward directly to the real instance before attempting magic methods on the proxy. Write contexts (BP_VAR_W/RW) are excluded since read_property with those types is a fallback from get_property_ptr_ptr for reference operations.

Also updates gh18038-004 and gh18038-007 test expectations to match -- these tests previously asserted the double-call behavior that phpGH-21478 reports as a bug.

Test plan

  • New gh21478.phpt test verifies __get fires once on the real instance
  • Updated gh18038-004.phpt / gh18038-007.phpt to remove expected double magic method call
  • Full Zend/tests/lazy_objects/ suite: 219/219 pass
  • Full Zend/tests/ suite: 5251/5251 pass (56 skipped)
  • Full ext/reflection/tests/ suite: 515/515 pass

…ed lazy proxies

When an initialized lazy proxy has __get/__isset, zend_std_read_property()
was calling the magic method on the proxy itself before forwarding to the
real instance at uninit_error. This caused double invocations: __get fired
on both the real instance and the proxy.

For pure reads (BP_VAR_R, BP_VAR_IS), forward directly to the real instance
before attempting magic methods on the proxy. Write contexts (BP_VAR_W/RW)
are excluded because read_property with those types is used as a fallback
from get_property_ptr_ptr for reference operations involving __get.

Closes phpGH-21478
@iliaal
Copy link
Owner Author

iliaal commented Mar 21, 2026

Submitted upstream as php#21480.

@iliaal iliaal closed this Mar 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Property access on lazy proxy may invoke magic method despite real instance guards

1 participant