Fixed bug #76466 (Loop variable confusion)

diff --git a/NEWS b/NEWS
index 70b13aae907a05967e73361937013813e4fce358..272a925d7bf5caf16cc8fdfe0414903192e4cf8b 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -22,6 +22,7 @@ PHP                                                                        NEWS
 - Opcache:
   . Fixed bug #76477 (Opcache causes empty return value).
     (Nikita, Laruence)
+  . Fixed bug #76466 (Loop variable confusion). (Dmitry, Laruence, Nikita)
   . Fixed bug #76463 (var has array key type but not value type). (Laruence)
   . Fixed bug #76446 (zend_variables.c:73: zend_string_destroy: Assertion
     `!(zval_gc_flags((str)->gc)). (Nikita, Laruence)

diff --git a/ext/opcache/Optimizer/sccp.c b/ext/opcache/Optimizer/sccp.c
index 5511313fae76851af824055243ad6134a6413e73..c9acb0498387cdc55f4091f6ef6d32141afe9f57 100644 (file)
--- a/ext/opcache/Optimizer/sccp.c
+++ b/ext/opcache/Optimizer/sccp.c
@@ -1230,6 +1230,7 @@ static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_o
                         * ADD_ARRAY_ELEMENT chain. We do this by only keeping the array on the last opcode
                         * and use a NULL value everywhere else. */
                        if (Z_TYPE(ctx->values[ssa_op->result_def]) == IS_NULL) {
+                               SET_RESULT_BOT(result);
                                return;
                        }
 

diff --git a/ext/opcache/tests/bug76466.phpt b/ext/opcache/tests/bug76466.phpt
new file mode 100644 (file)
index 0000000..0f492fb
--- /dev/null
+++ b/ext/opcache/tests/bug76466.phpt
@@ -0,0 +1,35 @@
+--TEST--
+Bug #76466 Loop variable confusion
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+function foo() {
+    for ($i = 0; $i < 2; $i++) {
+        $field_array[] = [$i, 0];
+    }
+    var_dump($field_array);
+}
+foo();
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  array(2) {
+    [0]=>
+    int(0)
+    [1]=>
+    int(0)
+  }
+  [1]=>
+  array(2) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(0)
+  }
+}