com php-src: Merge branch 'PHP-7.0' into PHP-7.1: ext/opcache/O ptimizer/zend_optimizer.c

Commit:    0b7fa040e9e83dedbbd4cb5dd6ab0f5aa3f840c9
Author:    Xinchen Hui <[email protected]>         Fri, 10 Feb 2017 14:24:44 +0800
Parents:   f352c50026e7b9e6116def1c201455f376e5c1a9 185304a61e08c07228e718139ef5284a7021bbbd
Branches:  PHP-7.1 master

Link:       http://git.php.net/?p=php-src.git;a=commitdiff;h=0b7fa040e9e83dedbbd4cb5dd6ab0f5aa3f840c9

Log:
Merge branch 'PHP-7.0' into PHP-7.1

* PHP-7.0:
  Fixed bug #74019 (Segfault with list)

Bugs:
https://bugs.php.net/74019

Changed paths:
  MM  ext/opcache/Optimizer/zend_optimizer.c


Diff:
diff --cc ext/opcache/Optimizer/zend_optimizer.c
index a30f184,7ae0e06..fbcb3a2
--- a/ext/opcache/Optimizer/zend_optimizer.c
+++ b/ext/opcache/Optimizer/zend_optimizer.c
@@@ -451,18 -406,32 +451,33 @@@ int zend_optimizer_replace_by_const(zen
  					break;
  				/* In most cases IS_TMP_VAR operand may be used only once.
  				 * The operands are usually destroyed by the opcode handler.
- 				 * ZEND_CASE is an exception, that keeps operand unchanged,
- 				 * and allows its reuse. The number of ZEND_CASE instructions
+ 				 * ZEND_CASE and ZEND_FETCH_LIST are exceptions, they keeps operand
+ 				 * unchanged, and allows its reuse. these instructions
  				 * usually terminated by ZEND_FREE that finally kills the value.
  				 */
- 				case ZEND_FREE:
- 				case ZEND_CASE: {
+ 				case ZEND_FETCH_LIST: {
+ 					zend_op *m = opline;
+ 					do {
+ 						if (m->opcode == ZEND_FETCH_LIST &&
+ 							ZEND_OP1_TYPE(m) == type &&
+ 							ZEND_OP1(m).var == var) {
+ 							zend_optimizer_update_op1_const(op_array, m, val);
+ 						}
+ 						m++;
+ 					} while (m->opcode != ZEND_FREE || ZEND_OP1_TYPE(m) != type || ZEND_OP1(m).var != var);
+ 					ZEND_ASSERT(m->opcode == ZEND_FREE && ZEND_OP1_TYPE(m) == type && ZEND_OP1(m).var == var);
+ 					MAKE_NOP(m);
++					zend_optimizer_remove_live_range(op_array, var);
+ 					return 1;
+ 				}
+ 				case ZEND_CASE:
+ 				case ZEND_FREE: {
  					zend_op *m, *n;
 -					int brk = op_array->last_brk_cont;
 +					int brk = op_array->last_live_range;
  					zend_bool in_switch = 0;
  					while (brk--) {
 -						if (op_array->brk_cont_array[brk].start <= (opline - op_array->opcodes) &&
 -								op_array->brk_cont_array[brk].brk > (opline - op_array->opcodes)) {
 +						if (op_array->live_range[brk].start <= (uint32_t)(opline - op_array->opcodes) &&
 +						    op_array->live_range[brk].end > (uint32_t)(opline - op_array->opcodes)) {
  							in_switch = 1;
  							break;
  						}