Fix bug #73847

Author: nikic

NEWS

@@ -37,6 +37,7 @@ PHP                                                                        NEWS
   . Fixed bug #73654 (Segmentation fault in zend_call_function). (Nikita)
   . Fixed bug #73668 ("SIGFPE Arithmetic exception" in opcache when divide by
     minus 1). (Nikita)
+  . Fixed bug #73847 (Recursion when a variable is redefined as array). (Nikita)
 
 - PDO_Firebird:
   . Fixed bug #72931 (PDO_FIREBIRD with Firebird 3.0 not work on returning

ext/opcache/Optimizer/dfa_pass.c

@@ -356,6 +356,12 @@ static zend_bool opline_supports_assign_contraction(
 		return opline->op1_type != IS_CV || opline->op1.var != cv_var;
 	}
 
+	if (opline->opcode == ZEND_INIT_ARRAY) {
+		/* INIT_ARRAY initializes the result array before reading key/value. */
+		return (opline->op1_type != IS_CV || opline->op1.var != cv_var)
+			&& (opline->op2_type != IS_CV || opline->op2.var != cv_var);
+	}
+
 	return 1;
 }
 

ext/opcache/tests/bug73847.phpt

@@ -0,0 +1,44 @@
+--TEST--
+Bug #73847: Recursion when a variable is redefined as array
+--FILE--
+<?php
+function test() {
+    $a = 42;
+    $a = array($a);
+    var_dump($a);
+
+    $a = 42;
+    $a = array($a => 24);
+    var_dump($a);
+
+    $a = 42;
+    $a = array($a, 24);
+    var_dump($a);
+
+    $a = 42;
+    $a = array(24, $a);
+    var_dump($a);
+}
+test();
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  int(42)
+}
+array(1) {
+  [42]=>
+  int(24)
+}
+array(2) {
+  [0]=>
+  int(42)
+  [1]=>
+  int(24)
+}
+array(2) {
+  [0]=>
+  int(24)
+  [1]=>
+  int(42)
+}