Fix phpGH-10571: Assertion `zval_get_type(&(*(zptr))) == 6 && "Concat should return string"' failed

Author: nielsdos

Zend/tests/gh10571.phpt

@@ -0,0 +1,25 @@
+--TEST--
+GH-10571: Assertion `zval_get_type(&(*(zptr))) == 6 && "Concat should return string"' failed
+--FILE--
+<?php
+class A
+{
+    public string $prop = "";
+}
+
+class B
+{
+    public function __toString()
+    {
+        global $a;
+        $a = "";
+        return "";
+    }
+}
+
+$a = new A();
+$a->prop .= new B();
+var_dump($a);
+?>
+--EXPECT--
+string(0) ""

Zend/zend_vm_def.h

@@ -1059,6 +1059,10 @@ ZEND_VM_C_LABEL(assign_op_object):
 				zval *orig_zptr = zptr;
 				zend_reference *ref;
 
+				if (OP1_TYPE == IS_CV) {
+					GC_ADDREF(zobj);
+				}
+
 				do {
 					if (UNEXPECTED(Z_ISREF_P(zptr))) {
 						ref = Z_REF_P(zptr);
@@ -1085,6 +1089,10 @@ ZEND_VM_C_LABEL(assign_op_object):
 				if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
 					ZVAL_COPY(EX_VAR(opline->result.var), zptr);
 				}
+
+				if (OP1_TYPE == IS_CV) {
+					GC_DTOR(zobj);
+				}
 			}
 		} else {
 			zend_assign_op_overloaded_property(zobj, name, cache_slot, value OPLINE_CC EXECUTE_DATA_CC);