From 643c4ba41790a215a54a4e82967a1a825b6d3fa0 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Sat, 30 Sep 2023 01:25:48 +0200
Subject: [PATCH] Revert "Fix GH-10008: Narrowing occurred during type
 inference of ZEND_ADD_ARRAY_ELEMENT"

Although it passes CI on 8.1, it causes CI failures in the JIT on 8.2 and
higher.
See https://github.com/php/php-src/actions/runs/6357716718/job/17269225001

This reverts commit e72fc12058dc0ee7bfe534dfa3daf46f3b357190.
---
 NEWS                               |  2 --
 Zend/Optimizer/zend_inference.c    | 30 +++++++++---------------------
 ext/opcache/tests/opt/gh10008.phpt | 30 ------------------------------
 3 files changed, 9 insertions(+), 53 deletions(-)
 delete mode 100644 ext/opcache/tests/opt/gh10008.phpt

diff --git a/NEWS b/NEWS
index 4158f8ad704..a6107b1a566 100644
--- a/NEWS
+++ b/NEWS
@@ -8,8 +8,6 @@ PHP                                                                        NEWS
   . Fixed bug GH-12215 (Module entry being overwritten causes type errors in
     ext/dom). (nielsdos)
   . Fixed bug GH-12273 (__builtin_cpu_init check). (Freaky)
-  . Fixed bug GH-10008 (Narrowing occurred during type inference of
-    ZEND_ADD_ARRAY_ELEMENT). (nielsdos, arnaud-lb)
 
 - CType:
   . Fixed bug GH-11997 (ctype_alnum 5 times slower in PHP 8.1 or greater).
diff --git a/Zend/Optimizer/zend_inference.c b/Zend/Optimizer/zend_inference.c
index b01c8b219ae..91a142a9f86 100644
--- a/Zend/Optimizer/zend_inference.c
+++ b/Zend/Optimizer/zend_inference.c
@@ -1926,21 +1926,6 @@ ZEND_API uint32_t zend_array_element_type(uint32_t t1, zend_uchar op_type, int w
 	return tmp;
 }
 
-static zend_always_inline uint32_t assign_long_dim_array_result_type(uint32_t arr_type)
-{
-	/* Rules:
-	 * HASH_ONLY      -> MAY_BE_ARRAY_NUMERIC_HASH
-	 * PACKED_ONLY    -> MAY_BE_ARRAY_NUMERIC_HASH | MAY_BE_ARRAY_PACKED (== MAY_BE_ARRAY_KEY_LONG)
-	 * HASH || PACKED -> MAY_BE_ARRAY_NUMERIC_HASH | MAY_BE_ARRAY_PACKED (== MAY_BE_ARRAY_KEY_LONG)
-	 * 0              -> MAY_BE_ARRAY_NUMERIC_HASH
-	 */
-	if (MAY_BE_PACKED(arr_type)) {
-		return MAY_BE_ARRAY_KEY_LONG;
-	} else {
-		return MAY_BE_ARRAY_NUMERIC_HASH;
-	}
-}
-
 static uint32_t assign_dim_array_result_type(
 		uint32_t arr_type, uint32_t dim_type, uint32_t value_type, zend_uchar dim_op_type) {
 	uint32_t tmp = 0;
@@ -1954,13 +1939,13 @@ static uint32_t assign_dim_array_result_type(
 			if (arr_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
 				tmp |= MAY_BE_ARRAY_PACKED;
 			}
-			tmp |= assign_long_dim_array_result_type(arr_type);
+			tmp |= MAY_BE_HASH_ONLY(arr_type) ? MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
 		} else {
 			if (dim_type & (MAY_BE_LONG|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_RESOURCE|MAY_BE_DOUBLE)) {
 				if (arr_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
 					tmp |= MAY_BE_ARRAY_PACKED;
 				}
-				tmp |= assign_long_dim_array_result_type(arr_type);
+				tmp |= MAY_BE_HASH_ONLY(arr_type) ? MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
 			}
 			if (dim_type & MAY_BE_STRING) {
 				tmp |= MAY_BE_ARRAY_KEY_STRING;
@@ -1969,7 +1954,7 @@ static uint32_t assign_dim_array_result_type(
 					if (arr_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
 						tmp |= MAY_BE_ARRAY_PACKED;
 					}
-					tmp |= assign_long_dim_array_result_type(arr_type);
+					tmp |= MAY_BE_HASH_ONLY(arr_type) ? MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
 				}
 			}
 			if (dim_type & (MAY_BE_UNDEF|MAY_BE_NULL)) {
@@ -3269,7 +3254,8 @@ static zend_always_inline int _zend_update_type_info(
 							key_type |= MAY_BE_ARRAY_PACKED;
 						}
 						if (t1 & MAY_BE_ARRAY) {
-							key_type |= assign_long_dim_array_result_type(t1);
+							key_type |= MAY_BE_HASH_ONLY(t1) ?
+								MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
 						}
 					} else {
 						if (t2 & (MAY_BE_LONG|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_RESOURCE|MAY_BE_DOUBLE)) {
@@ -3277,7 +3263,8 @@ static zend_always_inline int _zend_update_type_info(
 								key_type |= MAY_BE_ARRAY_PACKED;
 							}
 							if (t1 & MAY_BE_ARRAY) {
-								key_type |= assign_long_dim_array_result_type(t1);
+								key_type |= MAY_BE_HASH_ONLY(t1) ?
+									MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
 						    }
 						}
 						if (t2 & MAY_BE_STRING) {
@@ -3288,7 +3275,8 @@ static zend_always_inline int _zend_update_type_info(
 									key_type |= MAY_BE_ARRAY_PACKED;
 								}
 								if (t1 & MAY_BE_ARRAY) {
-									key_type |= assign_long_dim_array_result_type(t1);
+									key_type |= MAY_BE_HASH_ONLY(t1) ?
+										MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
 							    }
 							}
 						}
diff --git a/ext/opcache/tests/opt/gh10008.phpt b/ext/opcache/tests/opt/gh10008.phpt
deleted file mode 100644
index e92b7137bdb..00000000000
--- a/ext/opcache/tests/opt/gh10008.phpt
+++ /dev/null
@@ -1,30 +0,0 @@
---TEST--
-GH-10008 (Narrowing occurred during type inference of ZEND_ADD_ARRAY_ELEMENT)
---INI--
-opcache.enable=1
-opcache.enable_cli=1
-opcache.optimization_level=0x20
---EXTENSIONS--
-opcache
---FILE--
-<?php
-
-function test()
-{
-    $bool = true;
-    for ($i = 0; $i < 10; $i++) {
-        if ($bool !== true) {
-            $string_key = "a";
-            // The following line triggers narrowing during type inference of ZEND_ADD_ARRAY_ELEMENT.
-            $array = ["b" => $bool, $string_key => 123];
-        }
-
-        $bool = false;
-    }
-}
-
-echo "Done\n";
-
-?>
---EXPECT--
-Done