core: Warn when coercing NAN to other types

RFC: https://wiki.php.net/rfc/warnings-php-8-5#coercing_nan_to_other_types

Closes GH-19573

Author: Girgias

NEWS

@@ -17,6 +17,7 @@ PHP                                                                        NEWS
     (nielsdos)
   . Casting floats that are not representable as ints now emits a warning.
     (Girgias)
+  . Casting NAN to other types now emits a warning. (Girgias)
 
 - Bz2:
   . Fixed bug GH-19810 (Broken bzopen() stream mode validation). (ilutov)

UPGRADING

@@ -59,6 +59,8 @@ PHP 8.5 UPGRADE NOTES
     floats) to int if they cannot be represented as one. This affects explicit
     int casts and implicit int casts.
     RFC: https://wiki.php.net/rfc/warnings-php-8-5#casting_out_of_range_floats_to_int
+  . A warning is now emitted when casting NAN to other types.
+    RFC: https://wiki.php.net/rfc/warnings-php-8-5#coercing_nan_to_other_types
 
 - BZ2:
   . bzcompress() now throws a ValueError when $block_size is not between

Zend/Optimizer/block_pass.c

@@ -436,18 +436,11 @@ static void zend_optimize_block(zend_basic_block *block, zend_op_array *op_array
 					Tsource[VAR_NUM(opline->op1.var)] = NULL;
 					break;
 				}
-				ZEND_FALLTHROUGH;
-
-			case ZEND_IS_EQUAL:
-			case ZEND_IS_NOT_EQUAL:
 				if (opline->op1_type == IS_CONST &&
 				    opline->op2_type == IS_CONST) {
 					goto optimize_constant_binary_op;
 				}
-		        /* IS_EQ(TRUE, X)      => BOOL(X)
-		         * IS_EQ(FALSE, X)     => BOOL_NOT(X)
-		         * IS_NOT_EQ(TRUE, X)  => BOOL_NOT(X)
-		         * IS_NOT_EQ(FALSE, X) => BOOL(X)
+		        /*
 		         * CASE(TRUE, X)       => BOOL(X)
 		         * CASE(FALSE, X)      => BOOL_NOT(X)
 		         */
@@ -478,6 +471,21 @@ static void zend_optimize_block(zend_basic_block *block, zend_op_array *op_array
 					goto optimize_bool;
 				}
 				break;
+
+			case ZEND_IS_EQUAL:
+			case ZEND_IS_NOT_EQUAL:
+				if (opline->op1_type == IS_CONST &&
+					opline->op2_type == IS_CONST) {
+					goto optimize_constant_binary_op;
+				}
+				/* IS_EQ(TRUE, X)      => BOOL(X)
+				 * IS_EQ(FALSE, X)     => BOOL_NOT(X)
+				 * IS_NOT_EQ(TRUE, X)  => BOOL_NOT(X)
+				 * IS_NOT_EQ(FALSE, X) => BOOL(X)
+				 * Those optimizations are not safe if the other operand ends up being NAN
+				 * as BOOL/BOOL_NOT will warn, while IS_EQUAL/IS_NOT_EQUAL do not.
+				 */
+				break;
 			case ZEND_IS_IDENTICAL:
 				if (opline->op1_type == IS_CONST &&
 					opline->op2_type == IS_CONST) {

Zend/Optimizer/sccp.c

@@ -335,6 +335,10 @@ static inline zend_result ct_eval_bool_cast(zval *result, zval *op) {
 		ZVAL_TRUE(result);
 		return SUCCESS;
 	}
+	/* NAN warns when casting */
+	if (Z_TYPE_P(op) == IS_DOUBLE && zend_isnan(Z_DVAL_P(op))) {
+		return FAILURE;
+	}
 
 	ZVAL_BOOL(result, zend_is_true(op));
 	return SUCCESS;

Zend/Optimizer/zend_inference.c

@@ -5109,14 +5109,16 @@ ZEND_API bool zend_may_throw_ex(const zend_op *opline, const zend_ssa_op *ssa_op
 		case ZEND_PRE_DEC:
 		case ZEND_POST_DEC:
 			return (t1 & (MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
-		case ZEND_BOOL_NOT:
 		case ZEND_JMPZ:
 		case ZEND_JMPNZ:
 		case ZEND_JMPZ_EX:
 		case ZEND_JMPNZ_EX:
-		case ZEND_BOOL:
 		case ZEND_JMP_SET:
 			return (t1 & MAY_BE_OBJECT);
+		case ZEND_BOOL:
+		case ZEND_BOOL_NOT:
+			/* NAN Cast to bool will warn, but if we have a range it is fine */
+			return (t1 & MAY_BE_OBJECT) || ((t1 & MAY_BE_DOUBLE) && !OP1_HAS_RANGE());
 		case ZEND_BOOL_XOR:
 			return (t1 & MAY_BE_OBJECT) || (t2 & MAY_BE_OBJECT);
 		case ZEND_IS_EQUAL:

Zend/Optimizer/zend_optimizer.c

@@ -74,6 +74,9 @@ zend_result zend_optimizer_eval_unary_op(zval *result, uint8_t opcode, zval *op1
 		}
 		return unary_op(result, op1);
 	} else { /* ZEND_BOOL */
+		if (Z_TYPE_P(op1) == IS_DOUBLE && zend_isnan(Z_DVAL_P(op1))) {
+			return FAILURE;
+		}
 		ZVAL_BOOL(result, zend_is_true(op1));
 		return SUCCESS;
 	}

Zend/tests/optimizer/nan_warning_switch.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Checking NAN in a switch statement with true/false
+--FILE--
+<?php
+
+$nan = fdiv(0, 0);
+switch ($nan) {
+    case true:
+        echo "true";
+        break;
+    case false:
+        echo "false";
+        break;
+}
+?>
+--EXPECT--
+true

Zend/tests/type_coercion/float_to_int/explicit_casts_should_not_warn.phpt

@@ -26,6 +26,7 @@ foreach($values as $value) {
 
 ?>
 --EXPECTF--
+Warning: unexpected NAN value was coerced to string in %s on line %d
 int(3)
 int(3)
 

Zend/tests/type_coercion/float_to_int/explicit_casts_should_not_warn_32bit.phpt

@@ -1,5 +1,5 @@
 --TEST--
-Explicit (int) cast must not warn 32bit variation
+Explicit (int) cast must not warn if value is representable 32bit variation
 --SKIPIF--
 <?php
 if (PHP_INT_SIZE != 4) die("skip this test is for 32bit platform only");
@@ -26,6 +26,7 @@ foreach($values as $value) {
 
 ?>
 --EXPECTF--
+Warning: unexpected NAN value was coerced to string in %s on line %d
 int(3)
 int(3)
 

Zend/tests/type_coercion/float_to_int/union_int_string_type_arg.phpt

@@ -23,6 +23,8 @@ int(1)
 
 Deprecated: Implicit conversion from float 1.5 to int loses precision in %s on line %d
 int(1)
+
+Warning: unexpected NAN value was coerced to string in %s on line %d
 string(3) "NAN"
 string(8) "1.0E+121"
 string(3) "INF"