From: Nikita Popov <nikita.ppv@gmail.com>
Date: Mon, 18 Mar 2019 09:49:53 +0000 (+0100)
Subject: Fixed bug #77743
X-Git-Tag: php-7.3.4RC1~10^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=54bf8c820f4ac2c9204cd09b66fbe99c3db5939b;p=php

Fixed bug #77743
---

diff --git a/NEWS b/NEWS
index 88f91cfe73..abf5a572d3 100644
--- a/NEWS
+++ b/NEWS
@@ -35,6 +35,8 @@ PHP                                                                        NEWS
 - Opcache:
   . Fixed bug #77691 (Opcache passes wrong value for inline array push
     assignments). (Nikita)
+  . Fixed bug #77743 (Incorrect pi node insertion for jmpznz with identical
+    successors). (Nikita)
 
 - sodium:
   . Fixed bug #77646 (sign_detached() strings not terminated). (Frank)
diff --git a/ext/opcache/Optimizer/zend_ssa.c b/ext/opcache/Optimizer/zend_ssa.c
index 015c6bc0d5..d4ad655895 100644
--- a/ext/opcache/Optimizer/zend_ssa.c
+++ b/ext/opcache/Optimizer/zend_ssa.c
@@ -54,6 +54,14 @@ static zend_bool needs_pi(const zend_op_array *op_array, zend_dfg *dfg, zend_ssa
 		return 0;
 	}
 
+	/* Make sure that both sucessors of the from block aren't the same. Pi nodes are associated
+	 * with predecessor blocks, so we can't distinguish which edge the pi belongs to. */
+	from_block = &ssa->cfg.blocks[from];
+	ZEND_ASSERT(from_block->successors_count == 2);
+	if (from_block->successors[0] == from_block->successors[1]) {
+		return 0;
+	}
+
 	to_block = &ssa->cfg.blocks[to];
 	if (to_block->predecessors_count == 1) {
 		/* Always place pi if one predecessor (an if branch) */
@@ -62,8 +70,6 @@ static zend_bool needs_pi(const zend_op_array *op_array, zend_dfg *dfg, zend_ssa
 
 	/* Check that the other successor of the from block does not dominate all other predecessors.
 	 * If it does, we'd probably end up annihilating a positive+negative pi assertion. */
-	from_block = &ssa->cfg.blocks[from];
-	ZEND_ASSERT(from_block->successors_count == 2);
 	other_successor = from_block->successors[0] == to
 		? from_block->successors[1] : from_block->successors[0];
 	return !dominates_other_predecessors(&ssa->cfg, to_block, other_successor, from);
diff --git a/ext/opcache/tests/bug77743.phpt b/ext/opcache/tests/bug77743.phpt
new file mode 100644
index 0000000000..61627b198d
--- /dev/null
+++ b/ext/opcache/tests/bug77743.phpt
@@ -0,0 +1,34 @@
+--TEST--
+Bug #77743: Incorrect pi node insertion for jmpznz with identical successors
+--FILE--
+<?php
+class Toto
+{
+    public function process1()
+    {
+        $keep_products = [1, 2, 3, 4];
+        foreach ($keep_products as $k => $v)
+        {
+            $id_country = myRet(45);
+            if ($id_country === false && false)
+            {
+            }
+
+            var_dump($id_country === false);
+        }
+    }
+}
+
+function myRet($x){
+    return $x;
+}
+
+$toto = new Toto();
+$toto->process1();
+
+?>
+--EXPECT--
+bool(false)
+bool(false)
+bool(false)
+bool(false)