Fixed bug #73663 ("Invalid opcode 65/16/8" occurs with a variable created with list())

diff --git a/NEWS b/NEWS
index 1bd6df98cdd4b8c5720243a5755cd9c144d71739..901d9f5e077a8faa11bd5d5f2eb0d607e3764799 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? ??? 2016 PHP 7.0.15
 
 - Core:
+  . Fixed bug #73663 ("Invalid opcode 65/16/8" occurs with a variable created
+    with list()). (Laruence)
   . Fixed bug #73585 (Logging of "Internal Zend error - Missing class
     information" missing class name). (Laruence)
 

diff --git a/Zend/tests/bug73663.phpt b/Zend/tests/bug73663.phpt
new file mode 100644 (file)
index 0000000..66b9a05
--- /dev/null
+++ b/Zend/tests/bug73663.phpt
@@ -0,0 +1,73 @@
+--TEST--
+Bug #73663 ("Invalid opcode 65/16/8" occurs with a variable created with list())
+--FILE--
+<?php
+function change(&$ref) {
+       $ref = range(1, 10);
+       return;
+}
+
+$func = function (&$ref) {
+       return change($ref);
+};
+
+$array = [1];
+var_dump(list($val) = $array); // NG: Invalid opcode
+
+change(list($val) = $array);
+var_dump($array);
+
+$array = [1];
+
+$func(list($val) = $array);
+var_dump($array);
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  int(1)
+}
+array(10) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  int(4)
+  [4]=>
+  int(5)
+  [5]=>
+  int(6)
+  [6]=>
+  int(7)
+  [7]=>
+  int(8)
+  [8]=>
+  int(9)
+  [9]=>
+  int(10)
+}
+array(10) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  int(4)
+  [4]=>
+  int(5)
+  [5]=>
+  int(6)
+  [6]=>
+  int(7)
+  [7]=>
+  int(8)
+  [8]=>
+  int(9)
+  [9]=>
+  int(10)
+}

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index ca6b7f29c36c37a7157ccb7f28a584a551544892..4b7b9979a5b0f2b403da6ea99b33bfd27e2961b6 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -2781,12 +2781,21 @@ uint32_t zend_compile_args(zend_ast *ast, zend_function *fbc) /* {{{ */
                        }
                } else {
                        zend_compile_expr(&arg_node, arg);
-                       ZEND_ASSERT(arg_node.op_type != IS_CV);
                        if (arg_node.op_type == IS_VAR) {
                                opcode = ZEND_SEND_VAR_NO_REF;
                                if (fbc && ARG_MUST_BE_SENT_BY_REF(fbc, arg_num)) {
                                        flags |= ZEND_ARG_SEND_BY_REF;
                                }
+                       } else if (arg_node.op_type == IS_CV) {
+                               if (fbc) {
+                                       if (ARG_SHOULD_BE_SENT_BY_REF(fbc, arg_num)) {
+                                               opcode = ZEND_SEND_REF;
+                                       } else {
+                                               opcode = ZEND_SEND_VAR;
+                                       }
+                               } else {
+                                       opcode = ZEND_SEND_VAR_EX;
+                               }
                        } else {
                                if (fbc) {
                                        opcode = ZEND_SEND_VAL;