Weird PHP 7.2 bug

Hey:

Hi,

running:
https://raw.githubusercontent.com/xdebug/xdebug/master/tests/bug01263.inc

with:
$ php -n -dzend_extension=opcache.so -dopcache.enable_cli=1
tests/bug01263.inc

Produces the following output with PHP 7.2 build at Oct 29 2017 18:49:58:

In function PHP_CodeCoverage::addUncoveredFilesFromWhitelist (after sccp):
var 10 (CV $data) has array value type but not key type
var 15 (CV $data) has array value type but not key type
var 21 (CV $data) has array value type but not key type

In function PHP_CodeCoverage::addUncoveredFilesFromWhitelist (after
calls):
var 10 (CV $data) has array value type but not key type
var 15 (CV $data) has array value type but not key type
var 21 (CV $data) has array value type but not key type

In function PHP_CodeCoverage::addUncoveredFilesFromWhitelist (after dce):
var 10 (CV $data) has array value type but not key type
var 15 (CV $data) has array value type but not key type
var 21 (CV $data) has array value type but not key type

In function PHP_CodeCoverage::addUncoveredFilesFromWhitelist (after dfa):
var 10 (CV $data) has array value type but not key type
var 15 (CV $data) has array value type but not key type
var 21 (CV $data) has array value type but not key type

First, this won't bring any harm to execution, this is becuase we
know $uncoveredFiles
are IS_UNDEF for sure(thus the foreach block actually won't be executed),

then in typeinfo inference system, we will get $uncoveredFile with type
info 0.

then later while doing type inference for ZEND_FETCH_W
($data[$uncoveredFile][$i]
= ), since $unconveredFile has 0 type info, thus we won't get any key info
of the array ($data),

but in the current type inference system, FETCH_W's result will be used in
ASSIGN_DIM , then the system think $data maybe an array of
array(MAY_BE_ARRAY_OF_ARRAY).

which result: has array value type but not key type

anyway, I think infer type infos by usage is wrong here, we should only
trust def info, not use info...

so, I propose fix this by:
https://gist.github.com/laruence/9990ce5f9f3b30dd98dbff4f59109232

Dmitry, what do you think?

thanks

cheers,
Derick

--
https://derickrethans.nl | https://xdebug.org | https://dram.io
Like Xdebug? Consider a donation: https://xdebug.org/donate.php
twitter: @derickr and @xdebug

--

--
Xinchen Hui
@Laruence
http://www.laruence.com/

Hey:

Fixed. thanks. for catching.

Great

thanks

The real problem - incorrect handling of "wrong index type.

In this situation PHP should keep input array unchanged.

Inferring types "by usage" makes sense (for array)

e.g. $a[$n]++ should change the type of array.

I

Thanks. Dmitry.

---

From: Xinchen Hui laruence@php.net
Sent: Monday, October 30, 2017 10:05:30 AM
To: Derick Rethans
Cc: Dmitry Stogov; Nikita Popov; PHP Developers Mailing List
Subject: Re: [PHP-DEV] Weird PHP 7.2 bug

Hey:

Hi,

running:
https://raw.githubusercontent.com/xdebug/xdebug/master/tests/bug01263.inc

with:
$ php -n -dzend_extension=opcache.so -dopcache.enable_cli=1
tests/bug01263.inc

Produces the following output with PHP 7.2 build at Oct 29 2017 18:49:58:

In function PHP_CodeCoverage::addUncoveredFilesFromWhitelist (after
sccp):
var 10 (CV $data) has array value type but not key type
var 15 (CV $data) has array value type but not key type
var 21 (CV $data) has array value type but not key type

In function PHP_CodeCoverage::addUncoveredFilesFromWhitelist (after
calls):
var 10 (CV $data) has array value type but not key type
var 15 (CV $data) has array value type but not key type
var 21 (CV $data) has array value type but not key type

In function PHP_CodeCoverage::addUncoveredFilesFromWhitelist (after dce):
var 10 (CV $data) has array value type but not key type
var 15 (CV $data) has array value type but not key type
var 21 (CV $data) has array value type but not key type

In function PHP_CodeCoverage::addUncoveredFilesFromWhitelist (after dfa):
var 10 (CV $data) has array value type but not key type
var 15 (CV $data) has array value type but not key type
var 21 (CV $data) has array value type but not key type

First, this won't bring any harm to execution, this is becuase we know $uncoveredFiles
are IS_UNDEF for sure(thus the foreach block actually won't be executed),

then in typeinfo inference system, we will get $uncoveredFile with type
info 0.

then later while doing type inference for ZEND_FETCH_W ($data[$uncoveredFile][$i]
= ), since $unconveredFile has 0 type info, thus we won't get any key info
of the array ($data),

but in the current type inference system, FETCH_W's result will be used in
ASSIGN_DIM , then the system think $data maybe an array of
array(MAY_BE_ARRAY_OF_ARRAY).

which result: has array value type but not key type

anyway, I think infer type infos by usage is wrong here, we should only
trust def info, not use info...

so, I propose fix this by: https://gist.github.com/laruence/
9990ce5f9f3b30dd98dbff4f59109232

Dmitry, what do you think?

thanks

cheers,
Derick

--
https://derickrethans.nl | https://xdebug.org | https://dram.io
Like Xdebug? Consider a donation: https://xdebug.org/donate.php
twitter: @derickr and @xdebug

--

--
Xinchen Hui
@Laruence
http://www.laruence.com/

--
Xinchen Hui
@Laruence
http://www.laruence.com/