Fixed bug #77058

Account for the fact that undef must be interpreted as null for
the purposes of INC/DEC inference.

Author: nikic

NEWS

@@ -2,7 +2,8 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2018, PHP 7.1.25
 
-
+- Opcache:
+  . Fixed bug #77058 (Type inference in opcache causes side effects). (Nikita)
 
 08 Nov 2018, PHP 7.1.24
 

ext/opcache/Optimizer/zend_inference.c

@@ -2434,7 +2434,7 @@ static int zend_update_type_info(const zend_op_array *op_array,
 					tmp |= MAY_BE_RCN;
 				}
 			}
-			if ((t1 & MAY_BE_ANY) == MAY_BE_LONG) {
+			if ((t1 & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_LONG) {
 				if (!ssa_var_info[ssa_ops[i].op1_use].has_range ||
 				    (opline->opcode == ZEND_PRE_DEC &&
 				     (ssa_var_info[ssa_ops[i].op1_use].range.underflow ||
@@ -2496,7 +2496,7 @@ static int zend_update_type_info(const zend_op_array *op_array,
 			if (t1 & (MAY_BE_RC1|MAY_BE_RCN)) {
 				tmp |= MAY_BE_RC1;
 			}
-			if ((t1 & MAY_BE_ANY) == MAY_BE_LONG) {
+			if ((t1 & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_LONG) {
 				if (!ssa_var_info[ssa_ops[i].op1_use].has_range ||
 				     (opline->opcode == ZEND_PRE_DEC &&
 				      (ssa_var_info[ssa_ops[i].op1_use].range.underflow ||

ext/opcache/tests/bug77058.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #77058: Type inference in opcache causes side effects
+--FILE--
+<?php 
+
+function myfunc(){
+  $Nr = 0;
+  while(1){
+    $x--;
+    $x++;
+    if( ++ $Nr >= 2 ) break;
+  }
+  echo "'$Nr' is expected to be 2", PHP_EOL;
+}
+myfunc();
+
+?>
+--EXPECTF--
+Notice: Undefined variable: x in %s on line %d
+'2' is expected to be 2