Skip to content

Fix GH-23644: crash on a constant-vs-constant empty array comparison - #23648

Open
lazerg wants to merge 2 commits into
php:PHP-8.5from
lazerg:fix/gh-23644-empty-array-constconst
Open

Fix GH-23644: crash on a constant-vs-constant empty array comparison#23648
lazerg wants to merge 2 commits into
php:PHP-8.5from
lazerg:fix/gh-23644-empty-array-constconst

Conversation

@lazerg

@lazerg lazerg commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

When the optimizer proves a variable's value on a branch, it can substitute the constant in and leave a comparison whose two operands are both constants. ZEND_IS_IDENTICAL_EMPTY_ARRAY and ZEND_IS_NOT_IDENTICAL_EMPTY_ARRAY were the only handlers in that group declared without NO_CONST_CONST, unlike the base opcodes and the arithmetic handlers beside them, so the specialiser picked a variant that reads op1 as a variable slot. With a constant index there, the read lands outside the call frame and the process either crashes in zval_undefined_cv() or compares unrelated memory.

Adding the marker to both handlers is the fix ndossche suggested on the issue.

Fixes GH-23644

@ndossche

ndossche commented Sep 11, 2026

Copy link
Copy Markdown
Member

You know, if you take someone's patch verbatim and only add OP's test on top of it, then I think it's kinda rude to not give that someone (aka me in this case) credit: only your name is in the NEWS entry...

@lazerg

lazerg commented Sep 11, 2026

Copy link
Copy Markdown
Contributor Author

You're right, sorry about that. Commit d7abcf0 puts your name on the NEWS entry. The fix is your diff. I only regenerated the VM file and added a test. If you want, I can set you as the commit author too, or close this so you can open your own PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants