Fix COUNT range inference

count() on objects may return a negative number :(

diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index 10db7a00423c5ab505e4c6e85e3f9b1fd83f0633..1bfd395dd0853df08974c29d51164e073483e263 100644 (file)
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -1392,11 +1392,15 @@ int zend_inference_calc_range(const zend_op_array *op_array, zend_ssa *ssa, int
                                return 1;
                        }
                        break;
-               case ZEND_COUNT:
                case ZEND_FUNC_NUM_ARGS:
                        tmp->min = 0;
                        tmp->max = ZEND_LONG_MAX;
                        return 1;
+               case ZEND_COUNT:
+                       /* count() on Countable objects may return negative numbers */
+                       tmp->min = ZEND_LONG_MIN;
+                       tmp->max = ZEND_LONG_MAX;
+                       return 1;
                case ZEND_DO_FCALL:
                case ZEND_DO_ICALL:
                case ZEND_DO_UCALL: