archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix ASSIGN_DIM result inference with typed refs

Browse source 
Same issue as with ASSIGN. Also make the handling for ASSIGN more
precise, we can only have conversions between scalar values.
This commit is contained in:
Nikita Popov 2021-09-28 14:12:58 +02:00
parent cdc05eba61
commit 1bb7ee3207
2 changed files with 15 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
Zend/tests/assign_typed_ref_result.phpt
View file

@ -11,8 +11,16 @@ function test() {
$ref =& $obj->prop;
var_dump($ref = 0);
}
function test2() {
$obj = new Test;
$ary = [];
$ary[0] =& $obj->prop;
var_dump($ary[0] = 0);
}
test();
test2();
?>
--EXPECT--
string(1) "0"
string(1) "0"

10
ext/opcache/Optimizer/zend_inference.c
View file

@ -2757,6 +2757,10 @@ static zend_always_inline int _zend_update_type_info(
if (OP1_DATA_INFO() & MAY_BE_UNDEF) {
tmp |= MAY_BE_NULL;
}
if (t1 & MAY_BE_ARRAY_OF_REF) {
/* A scalar type conversion may occur when assigning to a typed reference. */
tmp |= MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING;
}
}
if (t1 & MAY_BE_OBJECT) {
tmp |= MAY_BE_REF;
@ -2866,9 +2870,9 @@ static zend_always_inline int _zend_update_type_info(
}
if (ssa_op->result_def >= 0) {
if (tmp & MAY_BE_REF) {
/* Assignment to typed reference may change type.
* Be conservative and don't assume anything. */
tmp = MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
/* A scalar type conversion may occur when assigning to a typed reference. */
tmp &= ~MAY_BE_REF;
tmp |= MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING|MAY_BE_RC1|MAY_BE_RCN;
}
UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
COPY_SSA_OBJ_TYPE(ssa_op->op2_use, ssa_op->result_def);