@@ -2810,31 +2810,21 @@ static zend_always_inline zend_result _zend_update_type_info(
2810
2810
if (t1 & MAY_BE_STRING ) {
2811
2811
tmp |= MAY_BE_STRING ;
2812
2812
}
2813
- if (t1 & (( MAY_BE_ANY | MAY_BE_UNDEF ) - MAY_BE_STRING )) {
2813
+ if (t1 & (MAY_BE_ARRAY | MAY_BE_FALSE | MAY_BE_NULL | MAY_BE_UNDEF )) {
2814
2814
tmp |= (OP1_DATA_INFO () & (MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF ));
2815
2815
2816
2816
if (OP1_DATA_INFO () & MAY_BE_UNDEF ) {
2817
2817
tmp |= MAY_BE_NULL ;
2818
2818
}
2819
- if (opline -> op2_type == IS_UNUSED ) {
2820
- /* When appending to an array and the LONG_MAX key is already used
2821
- * null will be returned. */
2822
- tmp |= MAY_BE_NULL ;
2823
- }
2824
- if (t2 & (MAY_BE_ARRAY | MAY_BE_OBJECT )) {
2825
- /* Arrays and objects cannot be used as keys. */
2826
- tmp |= MAY_BE_NULL ;
2827
- }
2828
- if (t1 & (MAY_BE_ANY - (MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_STRING | MAY_BE_ARRAY ))) {
2829
- /* undef, null and false are implicitly converted to array, anything else
2830
- * results in a null return value. */
2831
- tmp |= MAY_BE_NULL ;
2819
+ if (t1 & MAY_BE_ARRAY_OF_REF ) {
2820
+ /* A scalar type conversion may occur when assigning to a typed reference. */
2821
+ tmp |= MAY_BE_NULL |MAY_BE_FALSE |MAY_BE_TRUE |MAY_BE_LONG |MAY_BE_DOUBLE |MAY_BE_STRING ;
2832
2822
}
2833
2823
}
2834
- tmp |= MAY_BE_RC1 | MAY_BE_RCN ;
2835
2824
if (t1 & MAY_BE_OBJECT ) {
2836
2825
tmp |= MAY_BE_REF ;
2837
2826
}
2827
+ tmp |= MAY_BE_RC1 | MAY_BE_RCN ;
2838
2828
UPDATE_SSA_TYPE (tmp , ssa_op -> result_def );
2839
2829
}
2840
2830
if ((ssa_op + 1 )-> op1_def >= 0 ) {
@@ -2939,9 +2929,9 @@ static zend_always_inline zend_result _zend_update_type_info(
2939
2929
}
2940
2930
if (ssa_op -> result_def >= 0 ) {
2941
2931
if (tmp & MAY_BE_REF ) {
2942
- /* Assignment to typed reference may change type.
2943
- * Be conservative and don't assume anything. */
2944
- tmp = MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF ;
2932
+ /* A scalar type conversion may occur when assigning to a typed reference. */
2933
+ tmp &= ~ MAY_BE_REF ;
2934
+ tmp |= MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_TRUE | MAY_BE_LONG | MAY_BE_DOUBLE | MAY_BE_STRING | MAY_BE_RC1 | MAY_BE_RCN ;
2945
2935
}
2946
2936
UPDATE_SSA_TYPE (tmp , ssa_op -> result_def );
2947
2937
COPY_SSA_OBJ_TYPE (ssa_op -> op2_use , ssa_op -> result_def );
0 commit comments