Fix DFG construction for VERIFY_RETURN

`use` only contains uses prior to definition. This was not
honoured for VERIFY_RETURN with a temporary operand.

The test case only breaks on PHP 7.2.

diff --git a/ext/opcache/Optimizer/zend_dfg.c b/ext/opcache/Optimizer/zend_dfg.c
index 374c8146c8ab0e38ef01efece8653c9a3e684bc7..f39c6368cdd5d1db6ef68d791f7b7851cca31f86 100644 (file)
--- a/ext/opcache/Optimizer/zend_dfg.c
+++ b/ext/opcache/Optimizer/zend_dfg.c
@@ -144,11 +144,11 @@ op1_use:
                                        }
                                } else if (opline->op1_type & (IS_VAR|IS_TMP_VAR)) {
                                        var_num = EX_VAR_TO_NUM(opline->op1.var);
-                                       if (opline->opcode == ZEND_VERIFY_RETURN_TYPE) {
+                                       if (!DFG_ISSET(def, set_size, j, var_num)) {
                                                DFG_SET(use, set_size, j, var_num);
+                                       }
+                                       if (opline->opcode == ZEND_VERIFY_RETURN_TYPE) {
                                                DFG_SET(def, set_size, j, var_num);
-                                       } else if (!DFG_ISSET(def, set_size, j, var_num)) {
-                                               DFG_SET(use, set_size, j, var_num);
                                        }
                                }
                                if (opline->op2_type == IS_CV) {

diff --git a/ext/opcache/tests/verify_return_dfg.phpt b/ext/opcache/tests/verify_return_dfg.phpt
new file mode 100644 (file)
index 0000000..f2e6651
--- /dev/null
+++ b/ext/opcache/tests/verify_return_dfg.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Incorrect liveness computation for verify-return
+--FILE--
+<?php
+function test($foo): string
+{
+    switch ($foo) {
+        default:  $bar = 'x'; break;
+        case 'z': $bar = 'y'; break;
+    }
+    return (string)$bar;
+}
+?>
+===DONE===
+--EXPECT--
+===DONE===