Handle SWITCH_STRING with optimized away FREE

This can happen in degenerate cases where we know that the SWITCH_STRING argument is not refcounted. We should be treating it in the same way as SWITCH_LONG here.
php · Sep 16, 2021 · 7257e7e · 7257e7e
1 parent 236e7ae
commit 7257e7e
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 2 deletions.
diff --git a/Zend/zend_opcode.c b/Zend/zend_opcode.c
@@ -767,13 +767,13 @@ static zend_bool keeps_op1_alive(zend_op *opline) {
 	if (opline->opcode == ZEND_CASE
 	 || opline->opcode == ZEND_CASE_STRICT
 	 || opline->opcode == ZEND_SWITCH_LONG
+	 || opline->opcode == ZEND_SWITCH_STRING
 	 || opline->opcode == ZEND_MATCH
 	 || opline->opcode == ZEND_FETCH_LIST_R
 	 || opline->opcode == ZEND_COPY_TMP) {
 		return 1;
 	}
-	ZEND_ASSERT(opline->opcode != ZEND_SWITCH_STRING
-		&& opline->opcode != ZEND_FE_FETCH_R
+	ZEND_ASSERT(opline->opcode != ZEND_FE_FETCH_R
 		&& opline->opcode != ZEND_FE_FETCH_RW
 		&& opline->opcode != ZEND_FETCH_LIST_W
 		&& opline->opcode != ZEND_VERIFY_RETURN_TYPE

diff --git a/ext/opcache/tests/switch_string_free_opt.phpt b/ext/opcache/tests/switch_string_free_opt.phpt
@@ -0,0 +1,15 @@
+--TEST--
+A SWITCH_STRING operand FREE may be optimized away
+--FILE--
+<?php
+function test($a) {
+    switch (!$a) {
+        case '':
+            r>l;
+        default:
+    }
+}
+?>
+===DONE===
+--EXPECT--
+===DONE===