Fix SSA construction for ADD_ARRAY_ELEMENT in RC_INFERENCE mode

This was broken in cc29cbe80c0944097f8980384f883907d46512ce.

diff --git a/ext/opcache/Optimizer/zend_ssa.c b/ext/opcache/Optimizer/zend_ssa.c
index 168dbd00debc743941d1f865de1a663e90e0bfa0..0b1f967a93f5cef81571f863a5cce3adadd62de5 100644 (file)
--- a/ext/opcache/Optimizer/zend_ssa.c
+++ b/ext/opcache/Optimizer/zend_ssa.c
@@ -569,10 +569,6 @@ static int zend_ssa_rename(const zend_op_array *op_array, uint32_t build_flags,
                        }
 
                        switch (opline->opcode) {
-                               case ZEND_ADD_ARRAY_UNPACK:
-                               case ZEND_ADD_ARRAY_ELEMENT:
-                                       ssa_ops[k].result_use = var[EX_VAR_TO_NUM(opline->result.var)];
-                                       break;
                                case ZEND_ASSIGN:
                                        if ((build_flags & ZEND_SSA_RC_INFERENCE) && opline->op2_type == IS_CV) {
                                                ssa_ops[k].op2_def = ssa_vars_count;
@@ -718,6 +714,12 @@ add_op1_def:
                                                goto add_op1_def;
                                        }
                                        break;
+                               case ZEND_ADD_ARRAY_UNPACK:
+                                       ssa_ops[k].result_use = var[EX_VAR_TO_NUM(opline->result.var)];
+                                       break;
+                               case ZEND_ADD_ARRAY_ELEMENT:
+                                       ssa_ops[k].result_use = var[EX_VAR_TO_NUM(opline->result.var)];
+                                       /* break missing intentionally */
                                case ZEND_INIT_ARRAY:
                                        if (((build_flags & ZEND_SSA_RC_INFERENCE)
                                                                || (opline->extended_value & ZEND_ARRAY_ELEMENT_REF))

diff --git a/ext/opcache/tests/jit/array_elem.phpt b/ext/opcache/tests/jit/array_elem.phpt
new file mode 100644 (file)
index 0000000..542a872
--- /dev/null
+++ b/ext/opcache/tests/jit/array_elem.phpt
@@ -0,0 +1,28 @@
+--TEST--
+Refcount inference when adding array elements
+--FILE--
+<?php
+
+function test($a) {
+    $ary = [$a];
+    $ary2 = [0, $ary, $ary];
+    return $ary2;
+}
+var_dump(test(1));
+
+?>
+--EXPECT--
+array(3) {
+  [0]=>
+  int(0)
+  [1]=>
+  array(1) {
+    [0]=>
+    int(1)
+  }
+  [2]=>
+  array(1) {
+    [0]=>
+    int(1)
+  }
+}