From 0634967533c9bdc4aa081b7efde58b817554b99b Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Mon, 21 Feb 2022 16:27:53 +0100 Subject: [PATCH] Fix GH-8074: Wrong type inference of range() result If either the first or second operand of `range()` may be a string, we must not exclude the possibility that the result may be an array of longs. --- ext/opcache/Optimizer/zend_func_info.c | 2 +- ext/opcache/tests/opt/gh8074.phpt | 17 +++++++++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) create mode 100644 ext/opcache/tests/opt/gh8074.phpt diff --git a/ext/opcache/Optimizer/zend_func_info.c b/ext/opcache/Optimizer/zend_func_info.c index 84c9d20966ca..143717176b8d 100644 --- a/ext/opcache/Optimizer/zend_func_info.c +++ b/ext/opcache/Optimizer/zend_func_info.c @@ -78,7 +78,7 @@ static uint32_t zend_range_info(const zend_call_info *call_info, const zend_ssa || (t3 & (MAY_BE_DOUBLE|MAY_BE_STRING))) { tmp |= MAY_BE_ARRAY_OF_DOUBLE; } - if ((t1 & (MAY_BE_ANY-(MAY_BE_STRING|MAY_BE_DOUBLE))) && (t2 & (MAY_BE_ANY-(MAY_BE_STRING|MAY_BE_DOUBLE)))) { + if ((t1 & (MAY_BE_ANY-MAY_BE_DOUBLE)) && (t2 & (MAY_BE_ANY-MAY_BE_DOUBLE))) { if ((t3 & MAY_BE_ANY) != MAY_BE_DOUBLE) { tmp |= MAY_BE_ARRAY_OF_LONG; } diff --git a/ext/opcache/tests/opt/gh8074.phpt b/ext/opcache/tests/opt/gh8074.phpt new file mode 100644 index 000000000000..86ec3449c476 --- /dev/null +++ b/ext/opcache/tests/opt/gh8074.phpt @@ -0,0 +1,17 @@ +--TEST-- +GH-8074 (Wrong type inference of range() result) +--FILE-- + +--EXPECT-- +int(2) +int(3)