Fix ZEND_SR range inference

Handle out-of-range RHS correctly.

diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index 121d7a8ba3e5ad73ca100c97c55c2202fe9f2968..959b5148dda337c967186fa2d56eaab22b08c745 100644 (file)
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -740,6 +740,23 @@ static int zend_inference_calc_binary_op_range(
                                        op2_min = OP2_MIN_RANGE();
                                        op1_max = OP1_MAX_RANGE();
                                        op2_max = OP2_MAX_RANGE();
+
+                                       /* Shifts by negative numbers will throw, ignore them */
+                                       if (op2_min < 0) {
+                                               op2_min = 0;
+                                       }
+                                       if (op2_max < 0) {
+                                               op2_max = 0;
+                                       }
+
+                                       /* Shifts by more than the integer size will be 0 or -1 */
+                                       if (op2_min >= SIZEOF_ZEND_LONG * 8) {
+                                               op2_min = SIZEOF_ZEND_LONG * 8 - 1;
+                                       }
+                                       if (op2_max >= SIZEOF_ZEND_LONG * 8) {
+                                               op2_max = SIZEOF_ZEND_LONG * 8 - 1;
+                                       }
+
                                        t1 = op1_min >> op2_min;
                                        t2 = op1_min >> op2_max;
                                        t3 = op1_max >> op2_min;