From: Dmitry Stogov <dmitry@zend.com>
Date: Thu, 25 Mar 2021 13:00:36 +0000 (+0300)
Subject: Improved type inference for FE_FETCH_R
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=2f3538c2150eb2698fb024f97ff049bbb20642d7;p=php

Improved type inference for FE_FETCH_R
---

diff --git a/Zend/Optimizer/zend_inference.c b/Zend/Optimizer/zend_inference.c
index 8ba67a4dab..4233a8f7ef 100644
--- a/Zend/Optimizer/zend_inference.c
+++ b/Zend/Optimizer/zend_inference.c
@@ -3210,12 +3210,18 @@ static zend_always_inline int _zend_update_type_info(
 			break;
 		case ZEND_FE_FETCH_R:
 		case ZEND_FE_FETCH_RW:
-			tmp = t2 & MAY_BE_REF;
+			tmp = 0;
+			if (opline->op2_type == IS_CV) {
+				tmp = t2 & MAY_BE_REF;
+			}
 			if (t1 & MAY_BE_OBJECT) {
 				if (opline->opcode == ZEND_FE_FETCH_RW) {
 					tmp |= MAY_BE_REF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
 				} else {
-					tmp |= MAY_BE_REF | MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
+					tmp |= MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
+					if (opline->op2_type != IS_CV) {
+						tmp |= MAY_BE_REF;
+					}
 				}
 			}
 			if (t1 & MAY_BE_ARRAY) {
@@ -3228,6 +3234,9 @@ static zend_always_inline int _zend_update_type_info(
 					}
 					if (t1 & MAY_BE_ARRAY_OF_REF) {
 						tmp |= MAY_BE_RC1 | MAY_BE_RCN;
+						if (opline->op2_type != IS_CV) {
+							tmp |= MAY_BE_REF;
+						}
 					} else if (tmp & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
 						tmp |= MAY_BE_RC1 | MAY_BE_RCN;
 					}