archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix array cast type inference wrt packed arrays

Browse source 
Use KEY_LONG instead of PACKED if it's possible for the array to
be empty. It won't be packed in that case.

Fixes oss-fuzz #39650.
This commit is contained in:
Nikita Popov 2021-10-06 10:48:14 +02:00
parent f455894bb6
commit 3661c1932c
2 changed files with 23 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Zend/Optimizer/zend_inference.c
View file

@ -2534,8 +2534,8 @@ static zend_always_inline int _zend_update_type_info(
}
if (t1 & MAY_BE_OBJECT) {
tmp |= MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
} else {
tmp |= ((t1 & (MAY_BE_ANY - MAY_BE_NULL)) << MAY_BE_ARRAY_SHIFT) | ((t1 & (MAY_BE_ANY - MAY_BE_NULL)) ? MAY_BE_ARRAY_PACKED : 0);
} else if (t1 & (MAY_BE_ANY - MAY_BE_NULL)) {
tmp |= ((t1 & (MAY_BE_ANY - MAY_BE_NULL)) << MAY_BE_ARRAY_SHIFT) | ((t1 & MAY_BE_NULL) ? MAY_BE_ARRAY_KEY_LONG : MAY_BE_ARRAY_PACKED);
}
}
UPDATE_SSA_TYPE(tmp, ssa_op->result_def);

21
ext/opcache/tests/jit/cast_002.phpt Normal file
View file

@ -0,0 +1,21 @@
--TEST--
JIT CAST: 002
--INI--
opcache.enable=1
opcache.enable_cli=1
opcache.file_update_protection=0
opcache.jit_buffer_size=1M
--FILE--
<?php
function test(?int $i) {
$a = (array) $i;
$a[-1] = 1;
var_dump($a);
}
test(null);
?>
--EXPECT--
array(1) {
[-1]=>
int(1)
}