Returning by ref + finally allow circumventing return type checks

[iluuu1994]

Description

The following code:

https://3v4l.org/BRBW9

<?php

function &test(): int {
    $x = 0;
    try {
        return $x;
    } finally {
        $x = 'test';
    }
}

$x = &test();
var_dump($x);

Resulted in this output:

string(4) "test"

But I expected this output instead:

Fatal error: Uncaught TypeError: test(): Return value must be of type int, string returned

PHP Version

PHP 7.0.2+

Operating System

No response

[DanielEScherzer]

Naive guess that this might be from 778e5f3, which moved the finally handling to after the return type check