From: Nikita Popov <nikic@php.net>
Date: Sat, 26 Dec 2015 22:06:56 +0000 (+0100)
Subject: Don't reuse SSA var in UNSET_VAR
X-Git-Tag: php-7.1.0alpha1~617^2~134
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=33870c525a59d4a82ae679881b70c0267680b21f;p=php

Don't reuse SSA var in UNSET_VAR

Instead use the SSA var that UNSET_VAR actually defines. Otherwise
we get issues trying to DCE unsets.
---

diff --git a/ext/opcache/Optimizer/zend_dfg.c b/ext/opcache/Optimizer/zend_dfg.c
index d4fb283786..7c3e80db1f 100644
--- a/ext/opcache/Optimizer/zend_dfg.c
+++ b/ext/opcache/Optimizer/zend_dfg.c
@@ -106,6 +106,9 @@ int zend_build_dfg(const zend_op_array *op_array, const zend_cfg *cfg, zend_dfg
 						}
 						DFG_SET(gen, set_size, j, EX_VAR_TO_NUM(opline->op1.var));
 						break;
+					case ZEND_UNSET_VAR:
+						ZEND_ASSERT(opline->extended_value & ZEND_QUICK_SET);
+						/* break missing intentionally */
 					case ZEND_ASSIGN_ADD:
 					case ZEND_ASSIGN_SUB:
 					case ZEND_ASSIGN_MUL:
diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index 730f60343a..8fa9bfdbb5 100644
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -3299,9 +3299,13 @@ static void zend_update_type_info(const zend_op_array *op_array,
 			}
 			break;
 		case ZEND_UNSET_VAR:
-			if (opline->extended_value & ZEND_QUICK_SET) {
-				UPDATE_SSA_TYPE((MAY_BE_UNDEF|MAY_BE_RCN), ssa_ops[i].op1_def);
+			ZEND_ASSERT(opline->extended_value & ZEND_QUICK_SET);
+			tmp = MAY_BE_UNDEF|MAY_BE_RCN;
+			if (!op_array->function_name) {
+				/* In global scope, we know nothing */
+				tmp |= MAY_BE_REF;
 			}
+			UPDATE_SSA_TYPE(tmp, ssa_ops[i].op1_def);
 			break;
 		case ZEND_UNSET_DIM:
 		case ZEND_UNSET_OBJ:
diff --git a/ext/opcache/Optimizer/zend_ssa.c b/ext/opcache/Optimizer/zend_ssa.c
index d9e85165d9..505c0b978f 100644
--- a/ext/opcache/Optimizer/zend_ssa.c
+++ b/ext/opcache/Optimizer/zend_ssa.c
@@ -333,7 +333,7 @@ static int zend_ssa_rename(const zend_op_array *op_array, uint32_t build_flags,
 				case ZEND_UNSET_VAR:
 					if (opline->extended_value & ZEND_QUICK_SET) {
 						ssa_ops[k].op1_def = ssa_vars_count;
-						var[EX_VAR_TO_NUM(opline->op1.var)] = EX_VAR_TO_NUM(opline->op1.var);
+						var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
 						ssa_vars_count++;
 					}
 					break;