Fix live range calculation

nikic · nikic · commit 9a3b36a18f39 · 2019-01-21T13:01:41.000+01:00
diff --git a/Zend/zend_opcode.c b/Zend/zend_opcode.c
@@ -649,6 +649,9 @@ static void emit_live_range(
 			/* COPY_TMP has a split live-range: One from the definition until the use in
 			 * "null" branch, and another from the start of the "non-null" branch to the
 			 * FREE opcode. */
+			uint32_t rt_var_num =
+				(uint32_t) (intptr_t) ZEND_CALL_VAR_NUM(NULL, op_array->last_var + var_num);
+
 			zend_op *block_start_op = use_opline;
 			while ((block_start_op-1)->opcode == ZEND_FREE) {
 				block_start_op--;
@@ -659,10 +662,10 @@ static void emit_live_range(
 
 			do {
 				use_opline--;
-			} while (
-				(use_opline->op1_type & (IS_TMP_VAR|IS_VAR) && use_opline->op1.var == var_num) ||
-				(use_opline->op2_type & (IS_TMP_VAR|IS_VAR) && use_opline->op2.var == var_num)
-			);
+			} while (!(
+				((use_opline->op1_type & (IS_TMP_VAR|IS_VAR)) && use_opline->op1.var == rt_var_num) ||
+				((use_opline->op2_type & (IS_TMP_VAR|IS_VAR)) && use_opline->op2.var == rt_var_num)
+			));
 			start = def_opline + 1 - op_array->opcodes;
 			end = use_opline - op_array->opcodes;
 			emit_live_range_raw(
