Disable ASSIGN optimization for values inferred for fatal errors.

php · Feb 18, 2022 · 7e8257f · 7e8257f
1 parent 90ca8f9
commit 7e8257f
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 0 deletions.
diff --git a/Zend/Optimizer/dfa_pass.c b/Zend/Optimizer/dfa_pass.c
@@ -1356,6 +1356,7 @@ void zend_dfa_optimize_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx
 
 				if (src_var >= 0
 				 && !(ssa->var_info[src_var].type & MAY_BE_REF)
+				 && (ssa->var_info[src_var].type & (MAY_BE_UNDEF|MAY_BE_ANY))
 				 && ssa->vars[src_var].definition >= 0
 				 && ssa->ops[ssa->vars[src_var].definition].result_def == src_var
 				 && ssa->ops[ssa->vars[src_var].definition].result_use < 0
@@ -1513,6 +1514,7 @@ void zend_dfa_optimize_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx
 					if ((opline->op2_type & (IS_TMP_VAR|IS_VAR))
 					 && src_var >= 0
 					 && !(ssa->var_info[src_var].type & MAY_BE_REF)
+					 && (ssa->var_info[src_var].type & (MAY_BE_UNDEF|MAY_BE_ANY))
 					 && ssa->vars[src_var].definition >= 0
 					 && ssa->ops[ssa->vars[src_var].definition].result_def == src_var
 					 && ssa->ops[ssa->vars[src_var].definition].result_use < 0

diff --git a/ext/opcache/tests/jit/assign_051.phpt b/ext/opcache/tests/jit/assign_051.phpt
@@ -0,0 +1,23 @@
+--TEST--
+JIT ASSIGN: incorrect assignment optimization
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+opcache.protect_memory=1
+--FILE--
+<?php
+function foo(int $a) {
+    $arr = $a[] = (y);
+    $arr = y;
+    $c = $y = $arr = &y($c);
+}
+foo(0);
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Undefined constant "y" in %sassign_051.php:3
+Stack trace:
+#0 %sassign_051.php(7): foo(0)
+#1 {main}
+  thrown in %sassign_051.php on line 3