Don't const evaluate increment of array in SCCP

php · Sep 16, 2021 · 4c8093a · 4c8093a
1 parent 1548418
commit 4c8093a
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 0 deletions.
diff --git a/ext/opcache/Optimizer/sccp.c b/ext/opcache/Optimizer/sccp.c
@@ -704,6 +704,10 @@ static inline int ct_eval_assign_obj(zval *result, zval *value, zval *key) {
 }
 
 static inline int ct_eval_incdec(zval *result, zend_uchar opcode, zval *op1) {
+	if (Z_TYPE_P(op1) == IS_ARRAY || IS_PARTIAL_ARRAY(op1)) {
+		return FAILURE;
+	}
+
 	ZVAL_COPY(result, op1);
 	if (opcode == ZEND_PRE_INC
 			|| opcode == ZEND_POST_INC

diff --git a/ext/opcache/tests/inc_array.phpt b/ext/opcache/tests/inc_array.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Do not constant fold increment of array
+--FILE--
+<?php
+function test_inc_array() {
+    $a = [];
+    $a++;
+}
+function test_inc_partial_array($k) {
+    $a = [];
+    $a[$k] = 0;
+    $a++;
+}
+try {
+    test_inc_array();
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    test_inc_partial_array(0);
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+Cannot increment array
+Cannot increment array