Skip to content

Commit 8b7874b

Browse files
committed
Merge branch 'PHP-8.1'
* PHP-8.1: Fix ASSIGN_DIM result inference with typed refs Remove outdated code in ASSIGN_DIM type inference
2 parents 04dd327 + 69eb6e0 commit 8b7874b

File tree

2 files changed

+16
-18
lines changed

2 files changed

+16
-18
lines changed

Zend/Optimizer/zend_inference.c

Lines changed: 8 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -2810,31 +2810,21 @@ static zend_always_inline zend_result _zend_update_type_info(
28102810
if (t1 & MAY_BE_STRING) {
28112811
tmp |= MAY_BE_STRING;
28122812
}
2813-
if (t1 & ((MAY_BE_ANY|MAY_BE_UNDEF) - MAY_BE_STRING)) {
2813+
if (t1 & (MAY_BE_ARRAY|MAY_BE_FALSE|MAY_BE_NULL|MAY_BE_UNDEF)) {
28142814
tmp |= (OP1_DATA_INFO() & (MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF));
28152815

28162816
if (OP1_DATA_INFO() & MAY_BE_UNDEF) {
28172817
tmp |= MAY_BE_NULL;
28182818
}
2819-
if (opline->op2_type == IS_UNUSED) {
2820-
/* When appending to an array and the LONG_MAX key is already used
2821-
* null will be returned. */
2822-
tmp |= MAY_BE_NULL;
2823-
}
2824-
if (t2 & (MAY_BE_ARRAY | MAY_BE_OBJECT)) {
2825-
/* Arrays and objects cannot be used as keys. */
2826-
tmp |= MAY_BE_NULL;
2827-
}
2828-
if (t1 & (MAY_BE_ANY - (MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_STRING | MAY_BE_ARRAY))) {
2829-
/* undef, null and false are implicitly converted to array, anything else
2830-
* results in a null return value. */
2831-
tmp |= MAY_BE_NULL;
2819+
if (t1 & MAY_BE_ARRAY_OF_REF) {
2820+
/* A scalar type conversion may occur when assigning to a typed reference. */
2821+
tmp |= MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING;
28322822
}
28332823
}
2834-
tmp |= MAY_BE_RC1 | MAY_BE_RCN;
28352824
if (t1 & MAY_BE_OBJECT) {
28362825
tmp |= MAY_BE_REF;
28372826
}
2827+
tmp |= MAY_BE_RC1 | MAY_BE_RCN;
28382828
UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
28392829
}
28402830
if ((ssa_op+1)->op1_def >= 0) {
@@ -2939,9 +2929,9 @@ static zend_always_inline zend_result _zend_update_type_info(
29392929
}
29402930
if (ssa_op->result_def >= 0) {
29412931
if (tmp & MAY_BE_REF) {
2942-
/* Assignment to typed reference may change type.
2943-
* Be conservative and don't assume anything. */
2944-
tmp = MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
2932+
/* A scalar type conversion may occur when assigning to a typed reference. */
2933+
tmp &= ~MAY_BE_REF;
2934+
tmp |= MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING|MAY_BE_RC1|MAY_BE_RCN;
29452935
}
29462936
UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
29472937
COPY_SSA_OBJ_TYPE(ssa_op->op2_use, ssa_op->result_def);

Zend/tests/assign_typed_ref_result.phpt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,16 @@ function test() {
1111
$ref =& $obj->prop;
1212
var_dump($ref = 0);
1313
}
14+
function test2() {
15+
$obj = new Test;
16+
$ary = [];
17+
$ary[0] =& $obj->prop;
18+
var_dump($ary[0] = 0);
19+
}
1420
test();
21+
test2();
1522

1623
?>
1724
--EXPECT--
1825
string(1) "0"
26+
string(1) "0"

0 commit comments

Comments
 (0)