Fix type inference of SEND_UNPACK with empty array

An empty array will not be turned into an array of references.
This violated the invariant than an array has values iff it has
keys.

diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index 9e88e4566b1efc163c3bfbea2258fcbeb2e6146e..64d6ba1aa4454d31cd4dde2abefee944a9c099e4 100644 (file)
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -2856,8 +2856,10 @@ static int zend_update_type_info(const zend_op_array *op_array,
                                tmp = t1;
                                if (t1 & MAY_BE_ARRAY) {
                                        tmp |= MAY_BE_RC1 | MAY_BE_RCN;
-                                       /* SEND_UNPACK may acquire references into the array */
-                                       tmp |= MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
+                                       if (t1 & MAY_BE_ARRAY_OF_ANY) {
+                                               /* SEND_UNPACK may acquire references into the array */
+                                               tmp |= MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
+                                       }
                                }
                                if (t1 & MAY_BE_OBJECT) {
                                        tmp |= MAY_BE_RC1 | MAY_BE_RCN;

diff --git a/ext/opcache/tests/send_unpack_empty_array.phpt b/ext/opcache/tests/send_unpack_empty_array.phpt
new file mode 100644 (file)
index 0000000..4059ad4
--- /dev/null
+++ b/ext/opcache/tests/send_unpack_empty_array.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Type inference of SEND_UNPACK with empty array
+--FILE--
+<?php
+function test() {
+    $array = [1, 2, 3];
+    $values = [];
+    var_dump(array_push($array, 4, ...$values));
+    var_dump($array);
+}
+test();
+?>
+--EXPECT--
+int(4)
+array(4) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  int(4)
+}