From 28a016a6dca22566a6126b2b995fddcb8125c5e5 Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@zend.com>
Date: Wed, 23 Dec 2015 03:52:38 +0300
Subject: [PATCH] Fixed SSA construction for CFG with unreachable BB

---
 ext/opcache/Optimizer/zend_ssa.c   |  6 +++---
 ext/opcache/tests/ssa_bug_001.phpt | 19 +++++++++++++++++++
 2 files changed, 22 insertions(+), 3 deletions(-)
 create mode 100644 ext/opcache/tests/ssa_bug_001.phpt

diff --git a/ext/opcache/Optimizer/zend_ssa.c b/ext/opcache/Optimizer/zend_ssa.c
index 46c3928106..d9e85165d9 100644
--- a/ext/opcache/Optimizer/zend_ssa.c
+++ b/ext/opcache/Optimizer/zend_ssa.c
@@ -495,7 +495,7 @@ int zend_build_ssa(zend_arena **arena, const zend_op_array *op_array, uint32_t b
 				zend_bitset_copy(tmp, gen + (j * set_size), set_size);
 				for (k = 0; k < blocks[j].predecessors_count; k++) {
 					i = ssa->cfg.predecessors[blocks[j].predecessor_offset + k];
-					while (i != blocks[j].idom) {
+					while (i != -1 && i != blocks[j].idom) {
 						zend_bitset_union_with_intersection(tmp, tmp, gen + (i * set_size), in + (j * set_size), set_size);
 						i = blocks[i].idom;
 					}
@@ -530,7 +530,7 @@ int zend_build_ssa(zend_arena **arena, const zend_op_array *op_array, uint32_t b
 			} else {
 				for (k = 0; k < blocks[j].predecessors_count; k++) {
 					i = ssa->cfg.predecessors[blocks[j].predecessor_offset + k];
-					while (i != blocks[j].idom) {
+					while (i != -1 && i != blocks[j].idom) {
 						zend_bitset_union_with_intersection(tmp, tmp, gen + (i * set_size), in + (j * set_size), set_size);
 						i = blocks[i].idom;
 					}
@@ -802,7 +802,7 @@ int zend_build_ssa(zend_arena **arena, const zend_op_array *op_array, uint32_t b
 			} else {
 				for (k = 0; k < blocks[j].predecessors_count; k++) {
 					i = ssa->cfg.predecessors[blocks[j].predecessor_offset + k];
-					while (i != blocks[j].idom) {
+					while (i != -1 && i != blocks[j].idom) {
 						zend_ssa_phi *p = ssa_blocks[i].phis;
 						while (p) {
 							if (p) {
diff --git a/ext/opcache/tests/ssa_bug_001.phpt b/ext/opcache/tests/ssa_bug_001.phpt
new file mode 100644
index 0000000000..56757f56a4
--- /dev/null
+++ b/ext/opcache/tests/ssa_bug_001.phpt
@@ -0,0 +1,19 @@
+--TEST--
+SSA constrution for CFG with unreachable basic blocks
+--FILE--
+<?php
+class X {
+    public function __get($n) {
+      if ($n === 'type') {
+        trigger_error('Deprecated type property called; use instanceof', E_USER_NOTICE);
+        switch (get_class($this)) {
+          case 'HTMLPurifier_Token_Start':      return 'start';
+          default: return null;
+        }
+      }
+    }
+}
+?>
+OK
+--EXPECT--
+OK
-- 
2.40.0