Fix inference of COPY_TMP

iluuu1994 · iluuu1994 · commit cb1e84292957 · 2023-11-07T12:02:45.000+01:00
Since GH-11592 COPY_TMP may receive and thus define references. Unfortunately, the name COPY_TMP is no longer accurate. Closes GH-12619
diff --git a/NEWS b/NEWS
@@ -42,6 +42,7 @@ PHP                                                                        NEWS
   . Added warning when JIT cannot be enabled. (danog)
   . Fixed bug GH-8143 (Crashes in zend_accel_inheritance_cache_find since
     upgrading to 8.1.3 due to corrupt on-disk file cache). (turchanov)
+  . Fixed COPY_TMP type inference for references. (ilutov)
 
 - OpenSSL:
   . Fixed bug GH-12489 (Missing sigbio creation checking in openssl_cms_verify).
diff --git a/Zend/Optimizer/zend_inference.c b/Zend/Optimizer/zend_inference.c
@@ -2697,7 +2697,10 @@ static zend_always_inline zend_result _zend_update_type_info(
 				UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
 				COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
 			}
-			tmp = t1 & ~(MAY_BE_UNDEF|MAY_BE_REF);
+			tmp = t1 & ~MAY_BE_UNDEF;
+			if (opline->opcode != ZEND_COPY_TMP || opline->op1_type != IS_VAR) {
+				tmp &= ~MAY_BE_REF;
+			}
 			if (t1 & MAY_BE_UNDEF) {
 				tmp |= MAY_BE_NULL;
 			}
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
@@ -9516,6 +9516,7 @@ ZEND_VM_HANDLER(172, ZEND_FUNC_GET_ARGS, UNUSED|CONST, UNUSED)
 	ZEND_VM_NEXT_OPCODE();
 }
 
+/* Contrary to what its name indicates, ZEND_COPY_TMP may receive and define references. */
 ZEND_VM_HANDLER(167, ZEND_COPY_TMP, TMPVAR, UNUSED)
 {
 	USE_OPLINE
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h

Original file line number	Diff line number	Diff line change
`@@ -2697,7 +2697,10 @@ static zend_always_inline zend_result _zend_update_type_info(`
`2697`	`2697`	`UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);`
`2698`	`2698`	`COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);`
`2699`	`2699`	`}`
`2700`		`- tmp = t1 & ~(MAY_BE_UNDEF\|MAY_BE_REF);`
	`2700`	`+ tmp = t1 & ~MAY_BE_UNDEF;`
	`2701`	`+ if (opline->opcode != ZEND_COPY_TMP \|\| opline->op1_type != IS_VAR) {`
	`2702`	`+ tmp &= ~MAY_BE_REF;`
	`2703`	`+ }`
`2701`	`2704`	`if (t1 & MAY_BE_UNDEF) {`
`2702`	`2705`	`tmp \|= MAY_BE_NULL;`
`2703`	`2706`	`}`
Original file line number	Diff line number	Diff line change
`@@ -9516,6 +9516,7 @@ ZEND_VM_HANDLER(172, ZEND_FUNC_GET_ARGS, UNUSED\|CONST, UNUSED)`
`9516`	`9516`	`ZEND_VM_NEXT_OPCODE();`
`9517`	`9517`	`}`
`9518`	`9518`
	`9519`	`+/* Contrary to what its name indicates, ZEND_COPY_TMP may receive and define references. */`
`9519`	`9520`	`ZEND_VM_HANDLER(167, ZEND_COPY_TMP, TMPVAR, UNUSED)`
`9520`	`9521`	`{`
`9521`	`9522`	`USE_OPLINE`