From 4c8093a9f18da0bc347f63ef29fc9fc0b933236c Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikita.ppv@gmail.com>
Date: Thu, 16 Sep 2021 14:42:08 +0200
Subject: [PATCH] Don't const evaluate increment of array in SCCP

---
 ext/opcache/Optimizer/sccp.c     |  4 ++++
 ext/opcache/tests/inc_array.phpt | 27 +++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 ext/opcache/tests/inc_array.phpt

diff --git a/ext/opcache/Optimizer/sccp.c b/ext/opcache/Optimizer/sccp.c
index a8401c0c757..5992e9cb2a2 100644
--- a/ext/opcache/Optimizer/sccp.c
+++ b/ext/opcache/Optimizer/sccp.c
@@ -704,6 +704,10 @@ static inline int ct_eval_assign_obj(zval *result, zval *value, zval *key) {
 }
 
 static inline int ct_eval_incdec(zval *result, zend_uchar opcode, zval *op1) {
+	if (Z_TYPE_P(op1) == IS_ARRAY || IS_PARTIAL_ARRAY(op1)) {
+		return FAILURE;
+	}
+
 	ZVAL_COPY(result, op1);
 	if (opcode == ZEND_PRE_INC
 			|| opcode == ZEND_POST_INC
diff --git a/ext/opcache/tests/inc_array.phpt b/ext/opcache/tests/inc_array.phpt
new file mode 100644
index 00000000000..22355444816
--- /dev/null
+++ b/ext/opcache/tests/inc_array.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Do not constant fold increment of array
+--FILE--
+<?php
+function test_inc_array() {
+    $a = [];
+    $a++;
+}
+function test_inc_partial_array($k) {
+    $a = [];
+    $a[$k] = 0;
+    $a++;
+}
+try {
+    test_inc_array();
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    test_inc_partial_array(0);
+} catch (TypeError $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+Cannot increment array
+Cannot increment array