From 75b8d40eb5f7bfe12904f434e53fa7942fb3780d Mon Sep 17 00:00:00 2001 From: Ilija Tovilo Date: Wed, 24 Jan 2024 15:42:57 +0100 Subject: [PATCH] Improve ASSIGN_OBJ RC inference ASSIGN_OBJ may only modify RC if it implements __set. --- Zend/Optimizer/zend_inference.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/Zend/Optimizer/zend_inference.c b/Zend/Optimizer/zend_inference.c index 02b34c0ab7e0c..e3a98a184d316 100644 --- a/Zend/Optimizer/zend_inference.c +++ b/Zend/Optimizer/zend_inference.c @@ -3029,7 +3029,14 @@ static zend_always_inline zend_result _zend_update_type_info( break; case ZEND_ASSIGN_OBJ: if (opline->op1_type == IS_CV) { - tmp = (t1 & (MAY_BE_REF|MAY_BE_OBJECT))|MAY_BE_RC1|MAY_BE_RCN; + zend_class_entry *ce = ssa_var_info[ssa_op->op1_use].ce; + bool add_rc = !ce + || ce->__set + /* Non-default write_property may be set within create_object. */ + || ce->create_object + || ce->default_object_handlers->write_property != zend_std_write_property + || ssa_var_info[ssa_op->op1_use].is_instanceof; + tmp = (t1 & (MAY_BE_REF|MAY_BE_OBJECT|MAY_BE_RC1|MAY_BE_RCN))|(add_rc ? (MAY_BE_RC1|MAY_BE_RCN) : 0); UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def); }