From 609385bbf8fc82f334778bdfef5e16b7a3bd72c6 Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@gmail.com>
Date: Wed, 13 Jun 2018 15:06:51 +0800
Subject: [PATCH] Fixed bug #76446 (zend_variables.c:73: zend_string_destroy:
 Assertion `!(zval_gc_flags((str)->gc)).

---
 NEWS                            |  2 ++
 ext/opcache/Optimizer/dce.c     |  6 ++++--
 ext/opcache/tests/bug76446.phpt | 22 ++++++++++++++++++++++
 3 files changed, 28 insertions(+), 2 deletions(-)
 create mode 100644 ext/opcache/tests/bug76446.phpt

diff --git a/NEWS b/NEWS
index 13453f50a7..3b2ca4389a 100644
--- a/NEWS
+++ b/NEWS
@@ -17,6 +17,8 @@ PHP                                                                        NEWS
 
 - Opcache:
   . Fixed bug #76463 (var has array key type but not value type). (Laruence)
+  . Fixed bug #76446 (zend_variables.c:73: zend_string_destroy: Assertion
+    `!(zval_gc_flags((str)->gc)). (Nikita, Laruence)
 
 - ZIP:
   . Fixed bug #76461 (OPSYS_Z_CPM defined instead of OPSYS_CPM).
diff --git a/ext/opcache/Optimizer/dce.c b/ext/opcache/Optimizer/dce.c
index 4a35c9e5d3..58925975ca 100644
--- a/ext/opcache/Optimizer/dce.c
+++ b/ext/opcache/Optimizer/dce.c
@@ -39,7 +39,7 @@
  *    postdominator tree and of postdominance frontiers, which does not seem worthwhile at this
  *    point.
  *  * We separate intrinsic side-effects from potential side-effects in the form of notices thrown
- *    by the instruction (in case we want to make this configurable). See may_have_side_effect() and
+ *    by the instruction (in case we want to make this configurable). See may_have_side_effects() and
  *    zend_may_throw().
  *  * We often cannot DCE assignments and unsets while guaranteeing that dtors run in the same
  *    order. There is an optimization option to allow reordering of dtor effects.
@@ -109,7 +109,6 @@ static inline zend_bool may_have_side_effects(
 		case ZEND_CAST:
 		case ZEND_ROPE_INIT:
 		case ZEND_ROPE_ADD:
-		case ZEND_ROPE_END:
 		case ZEND_INIT_ARRAY:
 		case ZEND_ADD_ARRAY_ELEMENT:
 		case ZEND_SPACESHIP:
@@ -127,6 +126,9 @@ static inline zend_bool may_have_side_effects(
 		case ZEND_FUNC_GET_ARGS:
 			/* No side effects */
 			return 0;
+		case ZEND_ROPE_END:
+			/* TODO: Rope dce optmization, see #76446 */
+			return 1;
 		case ZEND_JMP:
 		case ZEND_JMPZ:
 		case ZEND_JMPNZ:
diff --git a/ext/opcache/tests/bug76446.phpt b/ext/opcache/tests/bug76446.phpt
new file mode 100644
index 0000000000..dfb676f4ba
--- /dev/null
+++ b/ext/opcache/tests/bug76446.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #76446 (zend_variables.c:73: zend_string_destroy: Assertion `!(zval_gc_flags((str)->gc)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+function test()
+{
+	$openmenu = '';
+	$openstr2 = "&amp;openmenu={$openmenu}{$addlang}\"";
+	return 0;
+}
+
+var_dump(test());
+?>
+--EXPECTF--
+Notice: Undefined variable: addlang in %sbug76446.php on line %d
+int(0)
-- 
2.49.0