From: Nikita Popov <nikita.ppv@gmail.com>
Date: Sat, 17 Feb 2018 22:04:31 +0000 (+0100)
Subject: Fix COUNT range inference
X-Git-Tag: php-7.2.4RC1~67
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=846e8a3ec9a748642bb08dbf38923a155146a3ad;p=php

Fix COUNT range inference

count() on objects may return a negative number :(
---

diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index 10db7a0042..1bfd395dd0 100644
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -1392,11 +1392,15 @@ int zend_inference_calc_range(const zend_op_array *op_array, zend_ssa *ssa, int
 				return 1;
 			}
 			break;
-		case ZEND_COUNT:
 		case ZEND_FUNC_NUM_ARGS:
 			tmp->min = 0;
 			tmp->max = ZEND_LONG_MAX;
 			return 1;
+		case ZEND_COUNT:
+			/* count() on Countable objects may return negative numbers */
+			tmp->min = ZEND_LONG_MIN;
+			tmp->max = ZEND_LONG_MAX;
+			return 1;
 		case ZEND_DO_FCALL:
 		case ZEND_DO_ICALL:
 		case ZEND_DO_UCALL: