Skip to content

Commit aced867

Browse files
committed
Fix typr inference
Fixes oss-fuzz #45020
1 parent f67986a commit aced867

File tree

2 files changed

+27
-0
lines changed

2 files changed

+27
-0
lines changed

Zend/Optimizer/zend_inference.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2661,6 +2661,7 @@ static zend_always_inline int _zend_update_type_info(
26612661
case ZEND_ASSIGN_DIM:
26622662
if (opline->op1_type == IS_CV) {
26632663
tmp = assign_dim_result_type(t1, t2, OP1_DATA_INFO(), opline->op2_type);
2664+
tmp |= ssa->var_info[ssa_op->op1_def].type & (MAY_BE_ARRAY_PACKED|MAY_BE_ARRAY_NUMERIC_HASH|MAY_BE_ARRAY_STRING_HASH);
26642665
UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
26652666
COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
26662667
}
Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
--TEST--
2+
JIT ASSIGN_DIM: 013
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.file_update_protection=0
7+
opcache.jit_buffer_size=1M
8+
--FILE--
9+
<?php
10+
function test() {
11+
for(;;) {
12+
$arr[] = $obj = new stdClass;
13+
$obj->y = set_error_handler(function(){});
14+
foreach($obj as $y) {
15+
}
16+
$arr = ['' => y];
17+
}
18+
}
19+
test();
20+
?>
21+
--EXPECTF--
22+
Fatal error: Uncaught Error: Undefined constant "y" in %sassign_dim_013.php:8
23+
Stack trace:
24+
#0 %sassign_dim_013.php(11): test()
25+
#1 {main}
26+
thrown in %sassign_dim_013.php on line 8

0 commit comments

Comments
 (0)