Fix

Author: nielsdos

Zend/Optimizer/dfa_pass.c

@@ -1126,12 +1126,13 @@ void zend_dfa_optimize_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx
 
 		// TODO: move me to other function?
 		for (v = 0; v < ssa->vars_count; v++) {
-			if (ssa->vars[v].var >= op_array->last_var) {
+			int var = ssa->vars[v].var;
+			if (var >= op_array->last_var) {
 				continue;
 			}
 
 			uint32_t type = ssa->var_info[v].type;
-			if (!(type & (MAY_BE_ANY-(MAY_BE_RC1|MAY_BE_ARRAY|MAY_BE_ARRAY_OF_ANY|MAY_BE_STRING)))) {
+			if (!(type & (MAY_BE_ANY-(MAY_BE_RC1|MAY_BE_ARRAY|MAY_BE_ARRAY_OF_ANY|MAY_BE_STRING|MAY_BE_NULL)))) {
 				continue;
 			}
 
@@ -1147,17 +1148,21 @@ void zend_dfa_optimize_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx
 				&& op_array->opcodes[use].opcode == ZEND_SEND_VAR
 				&& op_array->opcodes[use].op2_type == IS_UNUSED) {
 				int next_use = zend_ssa_next_use(ssa->ops, v, use);
-
+#if 0
 				if (next_use >= 0 && op_array->opcodes[next_use].opcode == ZEND_ASSIGN) {
-					fprintf(stderr, "v=%d next_use %d (%d, %d, %d)\n", v, next_use, ssa->ops[next_use].result_def, ssa->ops[next_use].result_use, ssa->ops[next_use].op1_use);
+					fprintf(stderr, "v=%d next_use %d (%d, %d, %d, %d)\n", v, next_use, ssa->ops[next_use].result_def, ssa->ops[next_use].result_use, ssa->ops[next_use].op1_use, ssa->ops[next_use].op2_use);
+					fprintf(stderr, "next_use var: %d (var=%d)\n", ssa->vars[next_use].var, var);
+					fprintf(stderr, "OP1: %d (var=%d)\n", ssa->vars[ssa->ops[next_use].op1_def].var, var);
 				}
-
+#endif
 				/* Either there is no next use which is okay, or the next use is an assignment
 				 * which overrides the previous value, which is also okay. */
 				if (next_use < 0
 					|| (op_array->opcodes[next_use].opcode == ZEND_ASSIGN
 						&& ssa->ops[next_use].op1_use == v
+						&& ssa->vars[v].var == var
 						&& zend_ssa_next_use(ssa->ops, v, next_use) < 0)) {
+							//fprintf(stderr, "HELLO\n");
 					ZEND_ASSERT(op_array->opcodes[use].extended_value == 0);
 					op_array->opcodes[use].extended_value = 1;
 				}

Zend/zend_vm_def.h

@@ -9900,6 +9900,7 @@ ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_SEND_VAR, op->op2_type == IS_UNUSED && op->ex
 	arg = ZEND_CALL_VAR(EX(call), opline->result.var);
 
 	ZVAL_COPY_VALUE(arg, varptr);
+	ZVAL_NULL(varptr);
 	//fprintf(stderr, "Hello world, %d\n", Z_REFCOUNTED_P(arg));
 
 	ZEND_VM_NEXT_OPCODE();

Zend/zend_vm_execute.h

@@ -3923,14 +3923,17 @@ static zend_always_inline void php_array_merge_wrapper(INTERNAL_FUNCTION_PARAMET
 		}
 	}
 
+	bool in_place = false;
 	arg = args;
 	src  = Z_ARRVAL_P(arg);
 	/* copy first array if necessary */
 	if (HT_IS_PACKED(src)) {
 		/* Note: If it has holes, it might get sequentialized */
 		if (HT_IS_WITHOUT_HOLES(src) && !(GC_FLAGS(Z_ARRVAL_P(arg)) & (IS_ARRAY_IMMUTABLE | IS_ARRAY_PERSISTENT)) && Z_REFCOUNT_P(arg) == 1) {
 			dest = src;
+			in_place = true;
 			ZVAL_ARR(return_value, dest);
+			//fprintf(stderr, "in-place %d\n", GC_REFCOUNT(Z_ARRVAL_P(return_value)));
 		} else {
 			array_init_size(return_value, count);
 			dest = Z_ARRVAL_P(return_value);
@@ -3977,6 +3980,11 @@ static zend_always_inline void php_array_merge_wrapper(INTERNAL_FUNCTION_PARAMET
 			php_array_merge(dest, Z_ARRVAL_P(arg));
 		}
 	}
+
+	if (in_place) {
+		GC_ADDREF(Z_ARRVAL_P(return_value));
+	}
+	//fprintf(stderr, "after, in-place %d %d\n", in_place, GC_REFCOUNT(Z_ARRVAL_P(return_value)));
 }
 /* }}} */