Fix updating SSA object type for *_ASSIGN_OP (#10458)

The code fetched the class entry into ce for objects and static
properties. However, when the actual update needs to take place (when
result_def exists), the class entry in ce was reset to NULL. So the SSA
object type update never happened. Fetch the class entry in the
result_def>=0 case instead after the reset of ce to NULL.
This commit is contained in:
Niels Dossche 2023-02-14 09:29:29 +01:00 committed by GitHub
parent 1a5fc6e1a3
commit d94ddbed2c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -2464,7 +2464,7 @@ static zend_always_inline int _zend_update_type_info(
if (opline->opcode == ZEND_ASSIGN_OBJ_OP) {
prop_info = zend_fetch_prop_info(op_array, ssa, opline, ssa_op);
orig = t1;
t1 = zend_fetch_prop_type(script, prop_info, &ce);
t1 = zend_fetch_prop_type(script, prop_info, NULL);
t2 = OP1_DATA_INFO();
} else if (opline->opcode == ZEND_ASSIGN_DIM_OP) {
if (t1 & MAY_BE_ARRAY_OF_REF) {
@ -2475,7 +2475,7 @@ static zend_always_inline int _zend_update_type_info(
t2 = OP1_DATA_INFO();
} else if (opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP) {
prop_info = zend_fetch_static_prop_info(script, op_array, ssa, opline);
t1 = zend_fetch_prop_type(script, prop_info, &ce);
t1 = zend_fetch_prop_type(script, prop_info, NULL);
t2 = OP1_DATA_INFO();
} else {
if (t1 & MAY_BE_REF) {
@ -2537,7 +2537,7 @@ static zend_always_inline int _zend_update_type_info(
} else if (opline->opcode == ZEND_ASSIGN_OBJ_OP) {
/* The return value must also satisfy the property type */
if (prop_info) {
t1 = zend_fetch_prop_type(script, prop_info, NULL);
t1 = zend_fetch_prop_type(script, prop_info, &ce);
if ((t1 & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_LONG
&& (tmp & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_DOUBLE) {
/* DOUBLE may be auto-converted to LONG */
@ -2549,7 +2549,7 @@ static zend_always_inline int _zend_update_type_info(
} else if (opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP) {
/* The return value must also satisfy the property type */
if (prop_info) {
t1 = zend_fetch_prop_type(script, prop_info, NULL);
t1 = zend_fetch_prop_type(script, prop_info, &ce);
if ((t1 & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_LONG
&& (tmp & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_DOUBLE) {
/* DOUBLE may be auto-converted to LONG */