Skip to content

Commit 1226fe0

Browse files
committed
Fixed codegeneration for ISSET_ISEMPTY_DIM
Fixes oss-fuzz #63805
1 parent 1c95e22 commit 1226fe0

File tree

2 files changed

+37
-0
lines changed

2 files changed

+37
-0
lines changed

ext/opcache/jit/zend_jit_ir.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11893,6 +11893,10 @@ static int zend_jit_fetch_dimension_address_inner(zend_jit_ctx *jit,
1189311893
}
1189411894

1189511895
if (type == BP_JIT_IS
11896+
&& !(op2_info & (MAY_BE_ANY|MAY_BE_UNDEF))) {
11897+
/* dead code */
11898+
ir_END_list(*end_inputs);
11899+
} else if (type == BP_JIT_IS
1189611900
&& (op1_info & MAY_BE_ARRAY)
1189711901
&& (op2_info & (MAY_BE_LONG|MAY_BE_STRING))
1189811902
&& test_zval_inputs->count) {

ext/opcache/tests/jit/isset_002.phpt

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
--TEST--
2+
ISSET_ISEMPTY_DIM with undefined variable
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.file_update_protection=0
7+
opcache.jit_buffer_size=1M
8+
--FILE--
9+
<?php
10+
function foo() {
11+
foreach ($how as $key => $value) {
12+
if (is_int($key)) {
13+
if (is_int($key)) {
14+
$keyy++;
15+
}
16+
if (isset($row[$key])) {
17+
return false;
18+
}
19+
}
20+
if (isset($row[$key])) {
21+
return false;
22+
}
23+
}
24+
return true;
25+
}
26+
foo();
27+
?>
28+
DONE
29+
--EXPECTF--
30+
Warning: Undefined variable $how in %sisset_002.php on line 3
31+
32+
Warning: foreach() argument must be of type array|object, null given in %sisset_002.php on line 3
33+
DONE

0 commit comments

Comments
 (0)