Fix DFG construction for VERIFY_RETURN

`use` only contains uses prior to definition. This was not honoured for VERIFY_RETURN with a temporary operand. The test case only breaks on PHP 7.2.
php · Jul 21, 2017 · 69ec51e · chx · Jul 21, 2017 · nikic
1 parent a8f98fc
commit 69ec51e
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 3 deletions.
diff --git a/ext/opcache/Optimizer/zend_dfg.c b/ext/opcache/Optimizer/zend_dfg.c
@@ -144,11 +144,11 @@ int zend_build_dfg(const zend_op_array *op_array, const zend_cfg *cfg, zend_dfg
 					}
 				} else if (opline->op1_type & (IS_VAR|IS_TMP_VAR)) {
 					var_num = EX_VAR_TO_NUM(opline->op1.var);
-					if (opline->opcode == ZEND_VERIFY_RETURN_TYPE) {
+					if (!DFG_ISSET(def, set_size, j, var_num)) {
 						DFG_SET(use, set_size, j, var_num);
+					}
+					if (opline->opcode == ZEND_VERIFY_RETURN_TYPE) {
 						DFG_SET(def, set_size, j, var_num);
-					} else if (!DFG_ISSET(def, set_size, j, var_num)) {
-						DFG_SET(use, set_size, j, var_num);
 					}
 				}
 				if (opline->op2_type == IS_CV) {

diff --git a/ext/opcache/tests/verify_return_dfg.phpt b/ext/opcache/tests/verify_return_dfg.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Incorrect liveness computation for verify-return
+--FILE--
+<?php
+function test($foo): string
+{
+    switch ($foo) {
+        default:  $bar = 'x'; break;
+        case 'z': $bar = 'y'; break;
+    }
+    return (string)$bar;
+}
+?>
+===DONE===
+--EXPECT--
+===DONE===