Fixed edge-case in SSA use/def chain construction and type inference.

1 files changed, 6 insertions, 3 deletions

diff --git a/ext/opcache/Optimizer/zend_ssa.h b/ext/opcache/Optimizer/zend_ssa.h
index b281305de2..1af4fabee4 100644
--- a/ext/opcache/Optimizer/zend_ssa.h
+++ b/ext/opcache/Optimizer/zend_ssa.h
@@ -180,10 +180,13 @@ END_EXTERN_C()
 static zend_always_inline int zend_ssa_next_use(const zend_ssa_op *ssa_op, int var, int use)
 {
 	ssa_op += use;
-	if (ssa_op->result_use == var) {
+	if (ssa_op->op1_use == var) {
+		return ssa_op->op1_use_chain;
+	} else if (ssa_op->op2_use == var) {
+		return ssa_op->op2_use_chain;
+	} else {
 		return ssa_op->res_use_chain;
 	}
-	return (ssa_op->op1_use == var) ? ssa_op->op1_use_chain : ssa_op->op2_use_chain;
 }
 
 static zend_always_inline zend_ssa_phi* zend_ssa_next_use_phi(const zend_ssa *ssa, int var, const zend_ssa_phi *p)
@@ -210,7 +213,7 @@ static zend_always_inline zend_bool zend_ssa_is_no_val_use(const zend_op *opline
 		return ssa_op->op2_use == var && ssa_op->op1_use != var;
 	}
 	if (ssa_op->result_use == var && opline->opcode != ZEND_ADD_ARRAY_ELEMENT) {
-		return 1;
+		return ssa_op->op1_use != var && ssa_op->op2_use != var;
 	}
 	return 0;
 }