[php-src] PR #23648: Fix GH-23644: crash on a constant-vs-constant empty array comparison
| From: | lazerg | Date: | Thu, 10 Sep 2026 22:06:32 +0000 |
| Subject: | [php-src] PR #23648: Fix GH-23644: crash on a constant-vs-constant empty array comparison | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38423@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23648
Author: lazerg
When the optimizer proves a variable's value on a branch, it can substitute the constant in and
leave a comparison whose two operands are both constants.
ZEND_IS_IDENTICAL_EMPTY_ARRAY
and ZEND_IS_NOT_IDENTICAL_EMPTY_ARRAY were the only handlers in that group declared
without NO_CONST_CONST, unlike the base opcodes and the arithmetic handlers beside
them, so the specialiser picked a variant that reads op1 as a variable slot. With a constant index
there, the read lands outside the call frame and the process either crashes in
zval_undefined_cv() or compares unrelated memory.
Adding the marker to both handlers is the fix ndossche suggested on the issue.
Fixes GH-23644