Fixed bug #79535

We did not allocate a cache slot for FETCH_CLASS. This is already
fixed on newer PHP versions.

Author: nikic

NEWS

@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.19
 
+- Opcache:
+  . Fixed bug #79535 (PHP crashes with specific opcache.optimization_level).
+    (Nikita)
+
 - SimpleXML:
   . Fixed bug #79528 (Different object of the same xml between 7.4.5 and
     7.4.4). (cmb)

ext/opcache/Optimizer/zend_optimizer.c

@@ -391,19 +391,20 @@ int zend_optimizer_update_op2_const(zend_op_array *op_array,
 				(opline + 1)->op2.var == opline->result.var) {
 				return 0;
 			}
-		case ZEND_ADD_INTERFACE:
-		case ZEND_ADD_TRAIT:
+			/* break missing intentionally */
+		case ZEND_INSTANCEOF:
 			REQUIRES_STRING(val);
 			drop_leading_backslash(val);
 			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
 			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
+			opline->extended_value = alloc_cache_slots(op_array, 1);
 			break;
-		case ZEND_INSTANCEOF:
+		case ZEND_ADD_INTERFACE:
+		case ZEND_ADD_TRAIT:
 			REQUIRES_STRING(val);
 			drop_leading_backslash(val);
 			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
 			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
-			opline->extended_value = alloc_cache_slots(op_array, 1);
 			break;
 		case ZEND_INIT_FCALL_BY_NAME:
 			REQUIRES_STRING(val);

ext/opcache/tests/bug79535.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #79535: PHP crashes with specific opcache.optimization_level
+--INI--
+opcache.optimization_level=0x000000a0
+--FILE--
+<?php
+function create() {
+    $name = stdClass::class;
+    return new $name;
+}
+var_dump(create());
+?>
+--EXPECT--
+object(stdClass)#1 (0) {
+}