Fixed bug #80194

We should strip NOPs from unreachable_free blocks as well, to make
sure that the free really is the first op.

Author: nikic

NEWS

@@ -29,6 +29,8 @@ PHP                                                                        NEWS
 - OPcache:
   . Fixed bug #80083 (Optimizer pass 6 removes variables used for ibm_db2 data
     binding). (Nikita)
+  . Fixed bug #80194 (Assertion failure during block assembly of unreachable
+    free with leading nop). (Nikita)
 
 - PCRE:
   . Updated to PCRE 10.35. (cmb)

Zend/tests/bug80194.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #80194: Assertion failure during block assembly of unreachable free with leading nop
+--FILE--
+<?php
+
+function test($x) {
+    switch ($x->y) {
+        default:
+            throw new Exception;
+        case 'foobar':
+            return new stdClass();
+            break;
+    }
+}
+
+$x = (object)['y' => 'foobar'];
+var_dump(test($x));
+
+?>
+--EXPECT--
+object(stdClass)#2 (0) {
+}

ext/opcache/Optimizer/block_pass.c

@@ -1941,7 +1941,7 @@ void zend_optimize_cfg(zend_op_array *op_array, zend_optimizer_ctx *ctx)
 
 		/* Eliminate NOPs */
 		for (b = blocks; b < end; b++) {
-			if (b->flags & ZEND_BB_REACHABLE) {
+			if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
 				strip_nops(op_array, b);
 			}
 		}