[php-src] Issue #24218: Opcache: "Invalid opcode 190/1/0" for count() of a literal array when SCCP is disabled in optimization_level

Issue: https://github.com/php/php-src/issues/24218 Author: waroad > With opcache on and SCCP (0x80) left out of > opcache.optimization_level, count() > of a literal array dies with Fatal error: Invalid opcode 190/1/0. ```php <?php echo count([1]); ``` ``` php -n -d opcache.enable_cli=1 -d opcache.file_update_protection=0 -d opcache.optimization_level=0x60 count.php ``` ``` Fatal error: Invalid opcode 190/1/0. in count.php on line 2 Stack trace: #0 {main} ``` > Expected output is 1, which is what the same build prints with > opcache off and with opcache at the default optimization level (where SCCP folds the call away). > 0x7FFEBF7F (the default level minus SCCP) fails the same way. > Found at commit b527e1b34ee97f4ea402e36a641509af7436759d, where a release build and an > ASan/UBSan build both give this fatal error with exit code 255 (no sanitizer report). Still > reproduces at c79284711bd8e610fb882bfdad48584b86fcdc62 (ASan/UBSan build). > Looks like zend_compile_func_count emits ZEND_COUNT with a > CONST op1, and after DFA zend_redo_pass_two_ex calls > zend_vm_set_opcode_handler_ex, which picks the COUNT_ARRAY type spec > because op1_info is MAY_BE_ARRAY without checking op1_type. COUNT_ARRAY is only declared for > CV|TMP (Zend/zend_vm_def.h), so its > CONST slot is the null handler. Found with an LLM-based testing tool. As CONTRIBUTING.md asks, the paragraphs in > quotes were written with Claude; I ran every command myself.