Fix GH-23644: crash on a constant-vs-constant empty array comparison - #23648
Open
lazerg wants to merge 2 commits into
Open
Fix GH-23644: crash on a constant-vs-constant empty array comparison#23648lazerg wants to merge 2 commits into
lazerg wants to merge 2 commits into
Conversation
Member
|
You know, if you take someone's patch verbatim and only add OP's test on top of it, then I think it's kinda rude to not give that someone (aka me in this case) credit: only your name is in the NEWS entry... |
Contributor
Author
|
You're right, sorry about that. Commit d7abcf0 puts your name on the NEWS entry. The fix is your diff. I only regenerated the VM file and added a test. If you want, I can set you as the commit author too, or close this so you can open your own PR. |
ndossche
approved these changes
Sep 11, 2026
ndossche
left a comment
Member
There was a problem hiding this comment.
I approve but I'm biased of course
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When the optimizer proves a variable's value on a branch, it can substitute the constant in and leave a comparison whose two operands are both constants.
ZEND_IS_IDENTICAL_EMPTY_ARRAYandZEND_IS_NOT_IDENTICAL_EMPTY_ARRAYwere the only handlers in that group declared withoutNO_CONST_CONST, unlike the base opcodes and the arithmetic handlers beside them, so the specialiser picked a variant that reads op1 as a variable slot. With a constant index there, the read lands outside the call frame and the process either crashes inzval_undefined_cv()or compares unrelated memory.Adding the marker to both handlers is the fix ndossche suggested on the issue.
Fixes GH-23644