From fc4836b193666958844e50bc35b93cc2da08b91c Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikita.ppv@gmail.com>
Date: Tue, 21 May 2019 16:59:27 +0200
Subject: [PATCH] Fix partial array handling in FE_RESET edge feasibility

---
 ext/opcache/Optimizer/sccp.c    |  5 ++++-
 ext/opcache/tests/bug78015.phpt | 12 ++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/ext/opcache/Optimizer/sccp.c b/ext/opcache/Optimizer/sccp.c
index 81c629b5b4..22f835527b 100644
--- a/ext/opcache/Optimizer/sccp.c
+++ b/ext/opcache/Optimizer/sccp.c
@@ -1909,7 +1909,10 @@ static void sccp_mark_feasible_successors(
 			break;
 		case ZEND_FE_RESET_R:
 		case ZEND_FE_RESET_RW:
-			if (Z_TYPE_P(op1) != IS_ARRAY && !IS_PARTIAL_ARRAY(op1)) {
+			/* A non-empty partial array is definitely non-empty, but an
+			 * empty partial array may be non-empty at runtime. */
+			if (Z_TYPE_P(op1) != IS_ARRAY ||
+					(IS_PARTIAL_ARRAY(op1) && zend_hash_num_elements(Z_ARR_P(op1)) == 0)) {
 				scdf_mark_edge_feasible(scdf, block_num, block->successors[0]);
 				scdf_mark_edge_feasible(scdf, block_num, block->successors[1]);
 				return;
diff --git a/ext/opcache/tests/bug78015.phpt b/ext/opcache/tests/bug78015.phpt
index e93c9ce9e4..a9feb82fb4 100644
--- a/ext/opcache/tests/bug78015.phpt
+++ b/ext/opcache/tests/bug78015.phpt
@@ -48,12 +48,23 @@ function test6() {
     return $d;
 }
 
+function test7() {
+    global $x;
+    $a = ['b' => [$x]];
+    $y = 1;
+    foreach ($a['b'] as $_) {
+        $y = 2;
+    }
+    return $y;
+}
+
 var_dump(test1());
 var_dump(test2());
 var_dump(test3());
 var_dump(test4());
 var_dump(test5());
 var_dump(test6());
+var_dump(test7());
 
 ?>
 --EXPECTF--
@@ -71,3 +82,4 @@ bool(true)
 
 Notice: Array to string conversion in %s on line %d
 string(11) "Arrayfoobar"
+int(2)
-- 
2.40.0