Fix leak for compound shift self-assign error cases

Author: nikic

Zend/tests/compound_shift_string_error.phpt

@@ -0,0 +1,31 @@
+--TEST--
+Error cases of compound shift assignment on strings
+--FILE--
+<?php
+
+$n = "65";
+$n <<= $n;
+var_dump($n);
+
+$n = "-1";
+$n <<= $n;
+var_dump($n);
+
+$n = "65";
+$n >>= $n;
+var_dump($n);
+
+$n = "-1";
+$n >>= $n;
+var_dump($n);
+
+?>
+--EXPECTF--
+int(0)
+
+Warning: Bit shift by negative number in %s on line %d
+bool(false)
+int(0)
+
+Warning: Bit shift by negative number in %s on line %d
+bool(false)

Zend/zend_operators.c

@@ -1451,6 +1451,10 @@ ZEND_API int shift_left_function(zval *result, zval *op1, zval *op2) /* {{{ */
 
 	convert_op1_op2_long(op1, op1_lval, op2, op2_lval, ZEND_SL, shift_left_function);
 
+	if (op1 == result) {
+		zval_dtor(result);
+	}
+
 	/* prevent wrapping quirkiness on some processors where << 64 + x == << x */
 	if (UNEXPECTED((zend_ulong)op2_lval >= SIZEOF_ZEND_LONG * 8)) {
 		if (EXPECTED(op2_lval > 0)) {
@@ -1463,9 +1467,6 @@ ZEND_API int shift_left_function(zval *result, zval *op1, zval *op2) /* {{{ */
 		}
 	}
 
-	if (op1 == result) {
-		zval_dtor(result);
-	}
 	ZVAL_LONG(result, op1_lval << op2_lval);
 	return SUCCESS;
 }
@@ -1477,6 +1478,10 @@ ZEND_API int shift_right_function(zval *result, zval *op1, zval *op2) /* {{{ */
 
 	convert_op1_op2_long(op1, op1_lval, op2, op2_lval, ZEND_SR, shift_right_function);
 
+	if (op1 == result) {
+		zval_dtor(result);
+	}
+
 	/* prevent wrapping quirkiness on some processors where >> 64 + x == >> x */
 	if (UNEXPECTED((zend_ulong)op2_lval >= SIZEOF_ZEND_LONG * 8)) {
 		if (EXPECTED(op2_lval > 0)) {
@@ -1489,9 +1494,6 @@ ZEND_API int shift_right_function(zval *result, zval *op1, zval *op2) /* {{{ */
 		}
 	}
 
-	if (op1 == result) {
-		zval_dtor(result);
-	}
 	ZVAL_LONG(result, op1_lval >> op2_lval);
 	return SUCCESS;
 }