From 08c29a657d054567f261ad1b4d9980d9375ec6d3 Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikita.ppv@gmail.com>
Date: Thu, 7 Oct 2021 15:34:34 +0200
Subject: [PATCH] Handle undefined dim in assign_dim_helper

Not only the value can be undefined here, but the offset as well.
---
 ext/opcache/jit/zend_jit_helpers.c        |  6 ++++++
 ext/opcache/tests/jit/assign_dim_004.phpt | 26 +++++++++++++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 ext/opcache/tests/jit/assign_dim_004.phpt

diff --git a/ext/opcache/jit/zend_jit_helpers.c b/ext/opcache/jit/zend_jit_helpers.c
index 5ca5815605e..2589526c854 100644
--- a/ext/opcache/jit/zend_jit_helpers.c
+++ b/ext/opcache/jit/zend_jit_helpers.c
@@ -1264,6 +1264,12 @@ static void ZEND_FASTCALL zend_jit_fetch_dim_obj_rw_helper(zval *object_ptr, zva
 
 static void ZEND_FASTCALL zend_jit_assign_dim_helper(zval *object_ptr, zval *dim, zval *value, zval *result)
 {
+	if (dim && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
+		const zend_op *opline = EG(current_execute_data)->opline;
+		zend_jit_undefined_op_helper(opline->op2.var);
+		dim = &EG(uninitialized_zval);
+	}
+
 	if (UNEXPECTED(Z_TYPE_P(value) == IS_UNDEF)) {
 		const zend_op *op_data = EG(current_execute_data)->opline + 1;
 		ZEND_ASSERT(op_data->opcode == ZEND_OP_DATA && op_data->op1_type == IS_CV);
diff --git a/ext/opcache/tests/jit/assign_dim_004.phpt b/ext/opcache/tests/jit/assign_dim_004.phpt
new file mode 100644
index 00000000000..f8d845221b5
--- /dev/null
+++ b/ext/opcache/tests/jit/assign_dim_004.phpt
@@ -0,0 +1,26 @@
+--TEST--
+JIT ASSIGN_DIM: 004
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+--FILE--
+<?php
+class Test implements ArrayAccess {
+    function offsetExists($x): bool {}
+    function offsetGet($x): mixed {}
+    function offsetSet($x, $y): void {
+        echo "offsetSet($x, $y)\n";
+    }
+    function offsetUnset($x): void {}
+}
+function test() {
+    $obj = new Test;
+    $obj[$undef] = 1;
+}
+test();
+?>
+--EXPECTF--
+Warning: Undefined variable $undef in %s on line %d
+offsetSet(, 1)