From: Dmitry Stogov <dmitry@zend.com>
Date: Mon, 4 Sep 2017 18:58:24 +0000 (+0300)
Subject: Fixed edge-case in SSA use/def chain construction and type inference.
X-Git-Tag: php-7.2.0RC2~48
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=384da65a97f1a2630454a319921cc279c7a286db;p=php

Fixed edge-case in SSA use/def chain construction and type inference.
---

diff --git a/ext/opcache/Optimizer/zend_ssa.h b/ext/opcache/Optimizer/zend_ssa.h
index b281305de2..1af4fabee4 100644
--- a/ext/opcache/Optimizer/zend_ssa.h
+++ b/ext/opcache/Optimizer/zend_ssa.h
@@ -180,10 +180,13 @@ END_EXTERN_C()
 static zend_always_inline int zend_ssa_next_use(const zend_ssa_op *ssa_op, int var, int use)
 {
 	ssa_op += use;
-	if (ssa_op->result_use == var) {
+	if (ssa_op->op1_use == var) {
+		return ssa_op->op1_use_chain;
+	} else if (ssa_op->op2_use == var) {
+		return ssa_op->op2_use_chain;
+	} else {
 		return ssa_op->res_use_chain;
 	}
-	return (ssa_op->op1_use == var) ? ssa_op->op1_use_chain : ssa_op->op2_use_chain;
 }
 
 static zend_always_inline zend_ssa_phi* zend_ssa_next_use_phi(const zend_ssa *ssa, int var, const zend_ssa_phi *p)
@@ -210,7 +213,7 @@ static zend_always_inline zend_bool zend_ssa_is_no_val_use(const zend_op *opline
 		return ssa_op->op2_use == var && ssa_op->op1_use != var;
 	}
 	if (ssa_op->result_use == var && opline->opcode != ZEND_ADD_ARRAY_ELEMENT) {
-		return 1;
+		return ssa_op->op1_use != var && ssa_op->op2_use != var;
 	}
 	return 0;
 }