[iliaal]

Summary

FETCH_DIM_W stripped MAY_BE_ARRAY_EMPTY only inside a block guarded by key_type & (MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING). When the key operand's type widened across loop iterations (e.g. from MAY_BE_ARRAY to include scalar types), key_type went from 0 to non-zero, causing the flag to be stripped on the second pass but not the first. This violated monotonicity and triggered the narrowing assertion.

Strips MAY_BE_ARRAY_EMPTY for write opcodes (W, RW, LIST_W) regardless of key_type, since a dimension write makes the array non-empty.

Fixes #17144

[dstogov]

This solution looks completely wrong.
The following PHP code doesn't modify $a (it throws exception) and $a is still empty.

$a = [];
$a[$a] = 1;

[iliaal]

Confirmed: $a = []; $a[$a] = 1; throws before the write, so unconditional stripping was wrong. Pushed a corrected version that strips MAY_BE_ARRAY_EMPTY only when the key is guaranteed valid: either op2 is IS_UNUSED (append) or t2 has no MAY_BE_ARRAY|MAY_BE_OBJECT bits. Once t2 gains ARRAY or OBJECT, the strip stays inactive, so the result type can only gain MAY_BE_ARRAY_EMPTY across iterations, never lose it. Test now covers both the original narrowing reproducer and the invalid-key throw path.

[kamil-tekiela]

I don't think this tests what you think it does. This compiles to ASSIGN_DIM

[iliaal]

Ah, indeed, that case never reached FETCH_DIM_W. Dropped it.

[kamil-tekiela]

Suggested change

	opcache.jit=1254
	opcache.optimization_level=-1

I think it shoud have been this.

[iliaal]

Done.

[kamil-tekiela]

 						}
 					}
-					if (opline->opcode != ZEND_FETCH_DIM_FUNC_ARG
-					 && (opline->op2_type == IS_UNUSED
-					  || !(t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT)))) {
-						tmp &= ~MAY_BE_ARRAY_EMPTY;
-					}
 				}
+				if (opline->opcode == ZEND_FETCH_DIM_W
+				 || opline->opcode == ZEND_FETCH_DIM_RW
+				 || opline->opcode == ZEND_FETCH_LIST_W) {
+					tmp &= ~MAY_BE_ARRAY_EMPTY;
+				}
 				if (!(tmp & MAY_BE_ARRAY)
 				 || (tmp & MAY_BE_ARRAY_KEY_ANY)

I think this might solve the problem.

Also, the test should be in ext/opcache/tests/opt/

[iliaal]

That is the first version of this PR, which Dmitry rejected above, so I kept the guarded strip. Moved the test to ext/opcache/tests/opt/.

[kamil-tekiela]

That is the first version of this PR, which Dmitry rejected above, so I kept the guarded strip. Moved the test to ext/opcache/tests/opt/.

Yes, but I think this is the correct solution. Dmitry's remark was a bit vague. Disregarding the difference between FETCH_DIM_W and FETCH_DIM_W, there seems to be no way that the inference can proceed past the throw. If there is a try-catch then inference won't work anyway. Other code already seems to work based on these assumptions. But I leave it to Dmitry to decide as he is the expert here.

[iliaal]

Agreed, DFA bails on any function with try/catch, so nothing observes the def past the throw.