Fixed incorrect optimization that may cause JIT assertion

Author: dstogov

ext/opcache/Optimizer/dfa_pass.c

@@ -360,6 +360,26 @@ static zend_bool opline_supports_assign_contraction(
 	return 1;
 }
 
+static bool variable_redefined_in_range(zend_ssa *ssa, int var, int start, int end)
+{
+	while (start < end) {
+		if (ssa->ops[start].op1_def >= 0
+		 && ssa->vars[ssa->ops[start].op1_def].var == var) {
+			return 1;
+		}
+		if (ssa->ops[start].op2_def >= 0
+		 && ssa->vars[ssa->ops[start].op2_def].var == var) {
+			return 1;
+		}
+		if (ssa->ops[start].result_def >= 0
+		 && ssa->vars[ssa->ops[start].result_def].var == var) {
+			return 1;
+		}
+		start++;
+	}
+	return 0;
+}
+
 int zend_dfa_optimize_calls(zend_op_array *op_array, zend_ssa *ssa)
 {
 	zend_func_info *func_info = ZEND_FUNC_INFO(op_array);
@@ -1290,6 +1310,8 @@ void zend_dfa_optimize_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx
 				 && opline_supports_assign_contraction(
 					 ssa, &op_array->opcodes[ssa->vars[src_var].definition],
 					 src_var, opline->result.var)
+				 && !variable_redefined_in_range(ssa, EX_VAR_TO_NUM(opline->result.var),
+						ssa->vars[src_var].definition+1, op_1)
 				) {
 
 					int orig_var = ssa->ops[op_1].result_use;
@@ -1445,6 +1467,8 @@ void zend_dfa_optimize_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx
 					 && opline_supports_assign_contraction(
 						 ssa, &op_array->opcodes[ssa->vars[src_var].definition],
 						 src_var, opline->op1.var)
+					 && !variable_redefined_in_range(ssa, EX_VAR_TO_NUM(opline->op1.var),
+							ssa->vars[src_var].definition+1, op_1)
 					) {
 
 						int op_2 = ssa->vars[src_var].definition;

ext/opcache/tests/jit/qm_assign_001.phpt

@@ -0,0 +1,14 @@
+--TEST--
+JIT QM_ASSIGN: 001 incorrect optimizarion
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+--FILE--
+<?php
+echo (1%1.5)-(1.5%1%1%-1)-1;
+?>
+--EXPECT--
+-1
+