| Commit message (Collapse) | Author | Age | Files | Lines |
|\
| |
| |
| |
| | |
* PHP-7.4:
Fix symtable cache being used while cleaning symtable
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
We need to first clean the symtable and then check whether a cache
slot is available for it. Otherwise, it may happen that a destructor
runs while cleaning the table and uses up all the remaining slots
in the cache.
This is particularly insidious because once we overflow the cache,
the first pointer we modify is symtable_cache_ptr, making it hard
to understand what happened after the fact.
Fixes oss-fuzz #30815.
|
| |
| |
| |
| | |
Fixes oss-fuzz#30764.
|
| |
| |
| |
| | |
As pointed out in comments on bug #66216.
|
| |
| |
| |
| |
| | |
Don't suggest "continue N+1" if there is no wrapping loop. The
resulting code would be illegal.
|
| |
| |
| |
| |
| |
| |
| | |
Cut off part after null byte when resolving the class name, to
avoid cutting off a larger part lateron.
Closes GH-6601.
|
| |
| |
| |
| |
| |
| |
| | |
I suspect this is only a partial fix for the issue, it's probably
possible to recurse through a more complex pathway as well.
Fixes oss-fuzz #28961.
|
| |
| |
| |
| |
| |
| |
| | |
This is not safe to do at this point. Even if we made it safe,
we'd see inconsistencies due to a partially compiled class.
Fixes oss-fuzz #28129.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
For a division like [1..1]/[2..2] produce [0..1] as a result, which
would be the integer envelope of the floating-point result.
The implementation is pretty ugly (we're now taking min/max across
eight values...) but I couldn't come up with a more elegant way
to handle this that doesn't make things a lot more complex (the
division sign handling is the annoying issue here).
|
| |
| |
| |
| |
| | |
Iterable was not considered a subtype of array|object, and thus
also not a subtype of mixed.
|
|\ \
| |/
| |
| |
| | |
* PHP-7.4:
Short-circuit get_gc for currently running generator
|
| | |
|
|\ \
| |/
| |
| |
| | |
* PHP-7.4:
Fix incorrectly optimized out live range
|
| |
| |
| |
| |
| |
| |
| | |
For x ? y : z style structures, the live range starts at z, but
may also hold the value of y. Make sure that the refcounting check
takes this into account, by checking the type of a potential phi
user.
|
|\ \
| |/
| |
| |
| | |
* PHP-7.4:
Fix #74558: Can't rebind closure returned by Closure::fromCallable()
|
| |
| |
| |
| |
| |
| |
| |
| | |
Failure to rebind such closures is not necessarily related to them
being created by `ReflectionFunctionAbstract::getClosure()`, so we fix
the error message.
Closes GH-6424.
|
| |
| |
| |
| |
| | |
If assert() was called with named args, add description as named
arg as well.
|
| |
| |
| |
| |
| |
| |
| |
| | |
Let's test the current behavior here. It might not be right, but
it's long-standing behavior.
Nearly missed an assertion failure here because the test was
XFAILed...
|
| |
| |
| |
| |
| | |
Even if the original issue only reproduces without opcache, we
should still allow running them with and without opcache.
|
| |
| |
| |
| | |
Closes GH-6396.
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
While fixing bugs in mbstring, one of my new test cases failed with a strange
error message stating: 'Warning: Undefined array key 1...', when clearly the
array key had been set properly.
GDB'd that sucker and found that JIT'd PHP code was calling directly into
`zend_hash_add_new` (which was not converting the numeric string key to an
integer properly). But where was that code coming from? I examined the disasm,
looked up symbols to figure out where call instructions were going, then grepped
the codebase for those function names. It soon became clear that the disasm I
was looking at was compiled from `zend_jit_fetch_dim_w_helper`.
|
|\ \
| |/
| |
| |
| | |
* PHP-7.4:
Fix SSA integrity violation for type inference in dead code
|
| |
| |
| |
| |
| |
| | |
The foreach body can never be executed and thus may contain empty
types. We should still uphold our SSA integrity invariants in that
case.
|
| |
| |
| |
| |
| |
| | |
See also https://externals.io/message/112083.
Closes GH-6364.
|
| |
| |
| |
| | |
Closes GH-6370
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This makes a number of related changes to the generator tree
management, that should hopefully make it easier to understand,
more robust and faster for the common linear-chain case. Fixes
https://bugs.php.net/bug.php?id=80240, which was the original
motivation here.
* Generators now only add a ref to their direct parent.
* Nodes only store their children, not their leafs, which avoids
any need for leaf updating. This means it's no longer possible
to fetch the child for a certain leaf, which is something we
only needed in one place (update_current). If multi-children
nodes are involved, this will require doing a walk in the other
direction (from leaf to root). It does not affect the common
case of single-child nodes.
* The root/leaf pointers are now seen as a pair. One leaf generator
can point to the current root. If a different leaf generator is
used, we'll move the root pointer over to that one. Again, this
is a cache to make the common linear chain case fast, trees may
need to scan up the parent link.
Closes GH-6344.
|
| |
| |
| |
| |
| |
| | |
This was a copy&paste mistake, target_block was used where
follow_block was intended. Also update copy&paste mistakes in
the comments.
|
| |
| |
| |
| |
| |
| |
| |
| | |
As filenames are no longer interned, we need to keep a reference
to the zend_string to make sure it isn't freed.
To avoid a nominal source compatibility break, create a new member
in the globals.
|
| | |
|
| |
| |
| |
| |
| |
| |
| | |
We need to perform trait scope fixup for both methods involved
in the inheritance check. For that purpose we already need to
thread through a separate fn scope through the entire inheritance
checking machinery.
|
| |
| |
| |
| |
| | |
Msan is missing interceptors for some functions that result in
false positives.
|
| |
| |
| |
| |
| |
| |
| | |
Run all functions with a varying number of null arguments, which
helps us flush out all kinds of bugs.
Closes GH-5881.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
If we have an undefined variable and null is not accepted by the
return type, we want to throw just the undef var error.
In this case this lead to an infinite loop, because we overwrite
the exception opline in SAVE_OPLINE and it does not get reset
when chaining into a previous exception. Add an assertiong to
catch this case earlier.
|
| |
| |
| |
| |
| | |
Namespaced and declares have a different interpretation of what
"first statement" means.
|
|\ \
| |/
| |
| |
| |
| | |
* PHP-7.4:
Detect self-addition of array more accurately
Deindirect source elements in zend_hash_merge
|
| |\
| | |
| | |
| | |
| | |
| | | |
* PHP-7.3:
Detect self-addition of array more accurately
Deindirect source elements in zend_hash_merge
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
While the zvals may be different, they may still point to the
same array.
Fixes oss-fuzz #26245.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
If the RHS has INDIRECT elements, we do not those to be added to
the LHS verbatim. As we're using UPDATE_INDIRECT, we might even
create a nested INDIRECT that way.
This is a side-quest of oss-fuzz #26245.
|
|\ \ \
| |/ /
| | |
| | |
| | | |
* PHP-7.4:
Fixed bug #80194
|
| | |
| | |
| | |
| | |
| | | |
We should strip NOPs from unreachable_free blocks as well, to make
sure that the free really is the first op.
|
|\ \ \
| |/ /
| | |
| | |
| | | |
* PHP-7.4:
Fix bug #80126
|
| | |
| | |
| | |
| | |
| | |
| | | |
When performing an unlinked instanceof, we also need to consider
interfaces of parent classes, as they may not have been inherited
yet.
|
| | | |
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Turns out we do need to return FAILURE here on div by zero
exception. Use a three-way return value from div_function_base.
Fixes oss-fuzz #25975.
|
| | |
| | |
| | |
| | |
| | |
| | | |
Intended to find issues in opaque object destructors.
Closes GH-6251.
|
| | |
| | |
| | |
| | | |
Closes GH-6214.
|
| | |
| | |
| | |
| | | |
Closes GH-6228
|
| | |
| | |
| | |
| | | |
Closes GH-6220
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Remove arbitrary restriction that attributes cannot be applied
to property/constant groups.
The attribute applies to all elements of the group, just like
modifiers and types do.
See also https://externals.io/message/111914.
Closes GH-6186.
|