From: Nikita Popov <nikita.ppv@gmail.com>
Date: Fri, 23 Jun 2017 15:32:45 +0000 (+0200)
Subject: Fixed bug #74623
X-Git-Tag: php-7.2.0alpha3~44^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=5b5a92b8b6d96b8fbd8557645801ae99310cab2b;p=php

Fixed bug #74623
---

diff --git a/NEWS b/NEWS
index eb0da993a1..cfc773f8f7 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,10 @@ PHP                                                                        NEWS
     (jhdxr)
   . Fixed bug #74761 (Unary operator expected error on some systems). (petk)
 
+- Opcache:
+  . Fixed bug #74623 (Infinite loop in type inference when using HTMLPurifier).
+    (nikic)
+
 - SPL:
   . Fixed bug #73471 (PHP freezes with AppendIterator). (jhdxr)
 
diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index d6a4c273bd..a1a6c7b611 100644
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -3109,7 +3109,7 @@ static int zend_update_type_info(const zend_op_array *op_array,
 				    opline->opcode == ZEND_FETCH_OBJ_RW ||
 				    opline->opcode == ZEND_FETCH_OBJ_FUNC_ARG) {
 					if (opline->opcode != ZEND_FETCH_DIM_FUNC_ARG) {
-						if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_NULL)) {
+						if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
 							tmp &= ~(MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE);
 							tmp |= MAY_BE_OBJECT | MAY_BE_RC1 | MAY_BE_RCN;
 						}
diff --git a/ext/opcache/tests/bug74623.phpt b/ext/opcache/tests/bug74623.phpt
new file mode 100644
index 0000000000..4cd0b26135
--- /dev/null
+++ b/ext/opcache/tests/bug74623.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #74623: Infinite loop in type inference when using HTMLPurifier
+--FILE--
+<?php
+
+function crash($arr) {
+    $current_item = false;
+
+    foreach($arr as $item) {
+        if($item->name === 'string') {
+            $current_item = $item;
+        } else {
+            $current_item->a[] = '';
+        }
+    }
+
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===