Fixed bug #76466 (Loop variable confusion)

Author: dstogov

NEWS

@@ -22,6 +22,7 @@ PHP                                                                        NEWS
 - Opcache:
   . Fixed bug #76477 (Opcache causes empty return value).
     (Nikita, Laruence)
+  . Fixed bug #76466 (Loop variable confusion). (Dmitry, Laruence, Nikita)
   . Fixed bug #76463 (var has array key type but not value type). (Laruence)
   . Fixed bug #76446 (zend_variables.c:73: zend_string_destroy: Assertion
     `!(zval_gc_flags((str)->gc)). (Nikita, Laruence)

ext/opcache/Optimizer/sccp.c

@@ -1230,6 +1230,7 @@ static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_o
 			 * ADD_ARRAY_ELEMENT chain. We do this by only keeping the array on the last opcode
 			 * and use a NULL value everywhere else. */
 			if (Z_TYPE(ctx->values[ssa_op->result_def]) == IS_NULL) {
+				SET_RESULT_BOT(result);
 				return;
 			}
 

ext/opcache/tests/bug76466.phpt

@@ -0,0 +1,35 @@
+--TEST--
+Bug #76466 Loop variable confusion
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+function foo() {
+    for ($i = 0; $i < 2; $i++) {
+        $field_array[] = [$i, 0];
+    }
+    var_dump($field_array);
+}
+foo();
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  array(2) {
+    [0]=>
+    int(0)
+    [1]=>
+    int(0)
+  }
+  [1]=>
+  array(2) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(0)
+  }
+}