php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-28 10:12:18 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix COPY_TMP live range construction after optimization

Browse Source 
If we optimize the FREE away, we should switch to constructing
a normal live range, rather than a split live range.

Fixes oss-fuzz #39548.
This commit is contained in:
Nikita Popov
2021-10-05 11:26:32 +02:00
parent cdcdb33080
commit bbd3f714d7
2 changed files with 25 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
Zend/tests/coalesce_assign_optimization.phpt Normal file
View File

@@ -0,0 +1,17 @@
--TEST--
Live range construction should not break if colesce assign branch is optimized away
--FILE--
<?php
function test() {
$a[X] ??= Y;
var_dump($a);
}
define('X', 1);
define('Y', 2);
test();
?>
--EXPECT--
array(1) {
[1]=>
int(2)
}

11
Zend/zend_opcode.c
View File

@@ -721,17 +721,22 @@ static void emit_live_range(
* "null" branch, and another from the start of the "non-null" branch to the
* FREE opcode. */
uint32_t rt_var_num = EX_NUM_TO_VAR(op_array->last_var + var_num);
zend_op *block_start_op = use_opline;
if (needs_live_range && !needs_live_range(op_array, orig_def_opline)) {
return;
}
kind = ZEND_LIVE_TMPVAR;
if (use_opline->opcode != ZEND_FREE) {
/* This can happen if one branch of the coalesce has been optimized away.
* In this case we should emit a normal live-range instead. */
break;
}
zend_op *block_start_op = use_opline;
while ((block_start_op-1)->opcode == ZEND_FREE) {
block_start_op--;
}
kind = ZEND_LIVE_TMPVAR;
start = block_start_op - op_array->opcodes;
if (start != end) {
emit_live_range_raw(op_array, var_num, kind, start, end);