From 2131feabbe4a7cafc6744dfd3958297630f64828 Mon Sep 17 00:00:00 2001
From: Ilija Tovilo <ilija.tovilo@me.com>
Date: Mon, 22 May 2023 16:30:38 +0200
Subject: [PATCH] Fix string coercion for $a .= $a

free_op2_string may be set to false when the operands are not strings, and
`result == op1 == op2`, by re-using the same string for both operands. In that
case, the string should still be copied to result because result is not actually
a string. Also change the op1 branch to stay consistent.

Introduced by GH-10049
---
 Zend/tests/bug79836_3.phpt | 10 ++++++++++
 Zend/zend_operators.c      |  4 ++--
 2 files changed, 12 insertions(+), 2 deletions(-)
 create mode 100644 Zend/tests/bug79836_3.phpt

diff --git a/Zend/tests/bug79836_3.phpt b/Zend/tests/bug79836_3.phpt
new file mode 100644
index 0000000000000..75262eb460fb4
--- /dev/null
+++ b/Zend/tests/bug79836_3.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #79836 ($a .= $a should coerce to string)
+--FILE--
+<?php
+$a = false;
+$a .= $a;
+var_dump($a);
+?>
+--EXPECT--
+string(0) ""
diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index c4fce74ebbbee..7e5e5ff3e0bdd 100644
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -2005,7 +2005,7 @@ ZEND_API zend_result ZEND_FASTCALL concat_function(zval *result, zval *op1, zval
 
 has_op2_string:;
 	if (UNEXPECTED(ZSTR_LEN(op1_string) == 0)) {
-		if (EXPECTED(free_op2_string || result != op2)) {
+		if (EXPECTED(result != op2 || Z_TYPE_P(result) != IS_STRING)) {
 			if (result == orig_op1) {
 				i_zval_ptr_dtor(result);
 			}
@@ -2018,7 +2018,7 @@ has_op2_string:;
 			}
 		}
 	} else if (UNEXPECTED(ZSTR_LEN(op2_string) == 0)) {
-		if (EXPECTED(free_op1_string || result != op1)) {
+		if (EXPECTED(result != op1 || Z_TYPE_P(result) != IS_STRING)) {
 			if (result == orig_op1) {
 				i_zval_ptr_dtor(result);
 			}