Error handler can change type of op

Fix the empty string case, don't think this is the solution for non ASCII strings as I'm not sure *what* the behaviour should be

Author: Girgias

Zend/tests/in-de-crement/decrement_diagnostic_change_type.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Error handler can change type of operand of --
+--FILE--
+<?php
+
+set_error_handler(function () {
+    global $x;
+    $x = 1;
+});
+
+$x = '';
+$x--;
+var_dump($x);
+
+?>
+DONE
+--EXPECT--
+int(-1)
+DONE

Zend/tests/in-de-crement/increment_diagnostic_change_type.phpt

@@ -0,0 +1,40 @@
+--TEST--
+Error handler can change type of operand of ++
+--FILE--
+<?php
+
+set_error_handler(function () {
+    global $x;
+    $x = 1;
+});
+
+$x = '';
+$x++;
+var_dump($x);
+
+set_error_handler(function ($errno, $errstr) {
+    var_dump($errstr);
+    global $x;
+    $x = new stdClass;
+});
+
+$x = 'foo!';
+$x++;
+var_dump($x);
+
+/* Interned string */
+$x = '!';
+$x++;
+var_dump($x);
+
+?>
+DONE
+--EXPECT--
+string(1) "1"
+string(50) "Increment on non-alphanumeric string is deprecated"
+object(stdClass)#3 (0) {
+}
+string(50) "Increment on non-alphanumeric string is deprecated"
+object(stdClass)#3 (0) {
+}
+DONE

Zend/tests/in-de-crement/increment_diagnostic_change_type_do_operator.phpt

@@ -0,0 +1,36 @@
+--TEST--
+Error handler can change type of operand of ++ to object with do_operator
+--EXTENSIONS--
+gmp
+--FILE--
+<?php
+
+set_error_handler(function ($errno, $errstr) {
+    var_dump($errstr);
+    global $x;
+    $x = gmp_init(10);
+});
+
+$x = 'foo!';
+$x++;
+var_dump($x);
+
+/* Interned string */
+$x = '!';
+$x++;
+var_dump($x);
+
+?>
+DONE
+--EXPECT--
+string(50) "Increment on non-alphanumeric string is deprecated"
+object(GMP)#2 (1) {
+  ["num"]=>
+  string(2) "10"
+}
+string(50) "Increment on non-alphanumeric string is deprecated"
+object(GMP)#2 (1) {
+  ["num"]=>
+  string(2) "10"
+}
+DONE

Zend/zend_operators.c

@@ -2506,7 +2506,7 @@ ZEND_API bool zend_string_only_has_ascii_alphanumeric(const zend_string *str)
 	return true;
 }
 
-static void ZEND_FASTCALL increment_string(zval *str) /* {{{ */
+static bool ZEND_FASTCALL increment_string(zval *str) /* {{{ */
 {
 	int carry=0;
 	size_t pos=Z_STRLEN_P(str)-1;
@@ -2515,20 +2515,25 @@ static void ZEND_FASTCALL increment_string(zval *str) /* {{{ */
 	int last=0; /* Shut up the compiler warning */
 	int ch;
 
-	if (Z_STRLEN_P(str) == 0) {
+	if (UNEXPECTED(Z_STRLEN_P(str) == 0)) {
 		zend_error(E_DEPRECATED, "Increment on non-alphanumeric string is deprecated");
 		if (EG(exception)) {
-			return;
+			return false;
 		}
-		zval_ptr_dtor_str(str);
+		/* A userland error handler can change the type from string to something else */
+		zval_ptr_dtor(str);
 		ZVAL_CHAR(str, '1');
-		return;
+		return true;
 	}
 
 	if (UNEXPECTED(!zend_string_only_has_ascii_alphanumeric(Z_STR_P(str)))) {
 		zend_error(E_DEPRECATED, "Increment on non-alphanumeric string is deprecated");
 		if (EG(exception)) {
-			return;
+			return false;
+		}
+		/* A userland error handler can change the type from string to something else */
+		if (Z_TYPE_P(str) != IS_STRING) {
+			return false;
 		}
 	}
 
@@ -2601,6 +2606,7 @@ static void ZEND_FASTCALL increment_string(zval *str) /* {{{ */
 		zend_string_free(Z_STR_P(str));
 		ZVAL_NEW_STR(str, t);
 	}
+	return true;
 }
 /* }}} */
 
@@ -2699,7 +2705,8 @@ ZEND_API zend_result ZEND_FASTCALL decrement_function(zval *op1) /* {{{ */
 				if (EG(exception)) {
 					return FAILURE;
 				}
-				zval_ptr_dtor_str(op1);
+				/* A userland error handler can change the type from string to something else */
+				zval_ptr_dtor(op1);
 				ZVAL_LONG(op1, -1);
 				break;
 			}