From: Dmitry Stogov <dmitry@zend.com>
Date: Tue, 17 Mar 2020 22:40:41 +0000 (+0300)
Subject: Result of ASSIGN may be different from the assigned value when LHS is a typed reference
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f767807986cf2ff17fe823fbf98693904cebf816;p=php

Result of ASSIGN may be different from the assigned value when LHS is a typed reference
---

diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c
index c472e49213..242ab347da 100644
--- a/ext/opcache/jit/zend_jit_trace.c
+++ b/ext/opcache/jit/zend_jit_trace.c
@@ -2711,7 +2711,10 @@ done:
 						type = STACK_VAR_TYPE(opline->op1.var);
 					}
 				} else if (opline->opcode == ZEND_ASSIGN) {
-					if (opline->op2_type != IS_CONST) {
+					if (opline->op2_type != IS_CONST
+					 && ssa_op->op1_use >= 0
+					 /* assignment to typed reference may cause conversion */
+					 && (ssa->var_info[ssa_op->op1_use].type & MAY_BE_REF) == 0) {
 						/* copy */
 						type = STACK_VAR_TYPE(opline->op2.var);
 					}