[php-src] master: Fix GH-24218: Invalid opcode for count() of a literal array without SCCP

Author: lazerg (lazerg) Committer: ndossche (ndossche) Date: 2026-10-09T18:50:12+02:00 Commit: https://github.com/php/php-src/commit/06be15d22e4b2eaa5ec46937dd08cfe5540627c2 Raw diff: https://github.com/php/php-src/commit/06be15d22e4b2eaa5ec46937dd08cfe5540627c2.diff Fix GH-24218: Invalid opcode for count() of a literal array without SCCP Closes GH-24219. Changed paths: A ext/opcache/tests/gh24218.phpt M NEWS M Zend/zend_vm_def.h M Zend/zend_vm_execute.h Diff: diff --git a/NEWS b/NEWS index 8dc808543b73..5c01150cabe4 100644 --- a/NEWS +++ b/NEWS @@ -13,6 +13,8 @@ PHP NEWS . Fixed memory manager keeping a block reallocated to exactly the size of the next smaller bin in its larger bin, which efree_size() then freed into the wrong one. (Marc Bennewitz) + . Fixed bug GH-24218 (Invalid opcode for count() of a literal array + without SCCP). (lazerg) - DOM: . Fixed bug GH-23352 (UAF reading an attribute value node retained across @@ -27,6 +29,8 @@ PHP NEWS . Fix type inference of ADD_ARRAY_UNPACK with integer keys. (ndossche) . Fix too wide type inference for ASSIGN_DIM_OP. (ndossche) . Fix OSS-Fuzz #568005340 (FETCH_DIM_FUNC_ARG partial conversion). (ndossche) + . Fixed bug GH-24218 (Invalid opcode for count() of a literal array when + SCCP is disabled). (Lazizbek Ergashev) - SOAP: . Fixed use of uninitialized func in do_request() on OOM bailout. diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index 566c9b4c4563..b0bda46f8c62 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -9451,7 +9451,7 @@ ZEND_VM_COLD_CONST_HANDLER(190, ZEND_COUNT, CONST|TMPVAR|CV, UNUSED) ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION(); } -ZEND_VM_TYPE_SPEC_HANDLER(ZEND_COUNT, (op1_info & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF)) == MAY_BE_ARRAY, ZEND_COUNT_ARRAY, CV|TMPVAR, UNUSED) +ZEND_VM_TYPE_SPEC_HANDLER(ZEND_COUNT, op->op1_type != IS_CONST && (op1_info & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF)) == MAY_BE_ARRAY, ZEND_COUNT_ARRAY, CV|TMPVAR, UNUSED) { USE_OPLINE zend_array *ht = Z_ARRVAL_P(GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R)); diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index 2ebbfaa9c05d..44def91de748 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -68529,7 +68529,7 @@ ZEND_API void ZEND_FASTCALL zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t } break; case ZEND_COUNT: - if ((op1_info & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF)) == MAY_BE_ARRAY) { + if (op->op1_type != IS_CONST && (op1_info & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF)) == MAY_BE_ARRAY) { spec = 2579 | SPEC_RULE_OP1; } break; diff --git a/ext/opcache/tests/gh24218.phpt b/ext/opcache/tests/gh24218.phpt new file mode 100644 index 000000000000..0e5721376bec --- /dev/null +++ b/ext/opcache/tests/gh24218.phpt @@ -0,0 +1,17 @@ +--TEST-- +GH-24218 (Invalid opcode for count() of a literal array when SCCP is disabled) +--EXTENSIONS-- +opcache +--INI-- +opcache.enable_cli=1 +opcache.optimization_level=0x60 +--FILE-- +<?php + +var_dump(count([1])); +var_dump(count([1, 2, 3])); + +?> +--EXPECT-- +int(1) +int(3)