Fix inference of COPY_TMP

iluuu1994 · iluuu1994 · commit 5c05d8cae810 · 2023-11-06T18:42:13.000+01:00
Since phpGH-11592 COPY_TMP may receive and thus define references. Unfortunately, the name COPY_TMP is no longer accurate.
diff --git a/Zend/Optimizer/zend_inference.c b/Zend/Optimizer/zend_inference.c
@@ -2698,7 +2698,10 @@ static zend_always_inline zend_result _zend_update_type_info(
 				UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
 				COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
 			}
-			tmp = t1 & ~(MAY_BE_UNDEF|MAY_BE_REF);
+			tmp = t1 & ~MAY_BE_UNDEF;
+			if (opline->opcode != ZEND_COPY_TMP || opline->op1_type != IS_VAR) {
+				tmp &= ~MAY_BE_REF;
+			}
 			if (t1 & MAY_BE_UNDEF) {
 				tmp |= MAY_BE_NULL;
 			}
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
@@ -9538,6 +9538,7 @@ ZEND_VM_HANDLER(172, ZEND_FUNC_GET_ARGS, UNUSED|CONST, UNUSED)
 	ZEND_VM_NEXT_OPCODE();
 }
 
+/* Contrary to what its name indicates, ZEND_COPY_TMP may receive and define references. */
 ZEND_VM_HANDLER(167, ZEND_COPY_TMP, TMPVAR, UNUSED)
 {
 	USE_OPLINE
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h

Original file line number	Diff line number	Diff line change
`@@ -2698,7 +2698,10 @@ static zend_always_inline zend_result _zend_update_type_info(`
`2698`	`2698`	`UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);`
`2699`	`2699`	`COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);`
`2700`	`2700`	`}`
`2701`		`- tmp = t1 & ~(MAY_BE_UNDEF\|MAY_BE_REF);`
	`2701`	`+ tmp = t1 & ~MAY_BE_UNDEF;`
	`2702`	`+ if (opline->opcode != ZEND_COPY_TMP \|\| opline->op1_type != IS_VAR) {`
	`2703`	`+ tmp &= ~MAY_BE_REF;`
	`2704`	`+ }`
`2702`	`2705`	`if (t1 & MAY_BE_UNDEF) {`
`2703`	`2706`	`tmp \|= MAY_BE_NULL;`
`2704`	`2707`	`}`
Original file line number	Diff line number	Diff line change
`@@ -9538,6 +9538,7 @@ ZEND_VM_HANDLER(172, ZEND_FUNC_GET_ARGS, UNUSED\|CONST, UNUSED)`
`9538`	`9538`	`ZEND_VM_NEXT_OPCODE();`
`9539`	`9539`	`}`
`9540`	`9540`
	`9541`	`+/* Contrary to what its name indicates, ZEND_COPY_TMP may receive and define references. */`
`9541`	`9542`	`ZEND_VM_HANDLER(167, ZEND_COPY_TMP, TMPVAR, UNUSED)`
`9542`	`9543`	`{`
`9543`	`9544`	`USE_OPLINE`