Assertion failure Zend/Optimizer/zend_inference.c:2086

[YuanchengJiang]

Description

The following code:

<?php
require "connect.inc";
$link = ldap_connect_and_bind($uri, $user, $passwd, $protocol_version);
insert_dummy_data($link, $base);
$result = ldap_list($link, "$base", "(objectClass=person)");
$entry = ldap_first_entry($link, $result);
var_dump(
$entry = ldap_next_entry($link, $entry),
ldap_get_values($link, $entry, 'sn'),
$entry = ldap_next_entry($link, $entry)
);
$fusion = $base;
function renderRawGraph(array $parents) {
$fusion = array();
foreach ($parents as $p) {
foreach ($graph as $graph) {
$graph[$graph]['line'] = 1;
}
$graph[] = array(
'line' => 1,
);
}
}

Resulted in this output:

Warning: Narrowing occurred during type inference of ZEND_FETCH_DIM_W. Please file a bug report on https://github.com/php/php-src/issues in /tmp/test.php on line 17
php: /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/Optimizer/zend_inference.c:2086: void emit_type_narrowing_warning(const zend_op_array *, zend_ssa *, int): Assertion `0 && "Narrowing during type inference"' failed.
Aborted (core dumped)

To reproduce (only in JIT):

-d "zend_extension=/home/phpfuzz/WorkSpace/flowfusion/php-src/modules/opcace.so" -d "opcache.enable=1" -d "opcache.enable_cli=1" -d "opcache.jit=1254"

PHP Version

nightly

Operating System

ubuntu 22.04

[cmb69]

Simplified reproducer:

function renderRawGraph(array $parents) {
    foreach ($parents as $p) {
        foreach ($graph as $graph) {
            $graph[$graph]['line'] = 1;
        }
        $graph[] = array(
            'line' => 1,
        );
    }
}

So not particularly related to ldap.

[ndossche]

Reproduces in 8.3 too, MAY_BE_ARRAY_EMPTY is lost at some point.
EDIT: to me it seems that the MAY_BE_ARRAY_EMPTY removal can happen regardless of the key type being set or not, which solves this for me but perhaps I am overlooking something. (EDIT: I guess if it throws during execution then the addition of MAY_BE_ARRAY_EMPTY would've been wrong)

[iluuu1994]

Reminds me, @YuanchengJiang you might want to consider compiling with -DZEND_VERIFY_TYPE_INFERENCE when running opcache without JIT. This might reveal some additional type inference bugs.

[YuanchengJiang]

@iluuu1994 thanks! noted