Fixed bug #78230

Author: nikic

NEWS

@@ -9,9 +9,11 @@ PHP                                                                        NEWS
   . Fixed #69044 (discrepency between time and microtime). (krakjoe)
   . Updated timelib to 2018.02. (Derick)
 
-- OPcache:
-  . Fixed #78189 (file cache strips last character of uname hash). (cmb)
-  . Fixed #78202 (Opcache stats for cache hits are capped at 32bit NUM). (cmb)
+- Opcache:
+  . Fixed bug #78189 (file cache strips last character of uname hash). (cmb)
+  . Fixed bug #78202 (Opcache stats for cache hits are capped at 32bit NUM).
+    (cmb)
+  . Fixed bug #78230 (Incorrect type check optimization). (Nikita)
 
 - PCRE:
   . Fixed bug #78197 (PCRE2 version check in configure fails for "##.##-xxx"

ext/opcache/Optimizer/sccp.c

@@ -2204,6 +2204,7 @@ static int try_remove_definition(sccp_ctx *ctx, int var_num, zend_ssa_var *var,
 				if (opline->opcode == ZEND_DO_ICALL) {
 					removed_ops = remove_call(ctx, opline, ssa_op);
 				} else if (opline->opcode == ZEND_TYPE_CHECK
+						&& opline->op1_type & (IS_VAR|IS_TMP_VAR)
 						&& !value_known(&ctx->values[ssa_op->op1_use])) {
 					/* For TYPE_CHECK we may compute the result value without knowing the
 					 * operand, based on type inference information. Make sure the operand is

ext/opcache/tests/bug78230.phpt

@@ -0,0 +1,29 @@
+--TEST--
+Bug #78230: Incorrect type check optimization
+--FILE--
+<?php
+
+function test($x) {
+    $y = (array) $x;
+    var_dump(is_array($y));
+}
+
+$ary = [1, 2];
+$ary[] = 3;
+test($ary);
+$ary[] = 4;
+var_dump($ary);
+
+?>
+--EXPECT--
+bool(true)
+array(4) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  int(4)
+}