Zend: add VM spec for ZEND_VERIFY_TYPE_RETURN for string values

Author: Girgias

Zend/zend_vm_def.h

@@ -4572,6 +4572,77 @@ ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_VERIFY_RETURN_TYPE, (((res_info & MAY_BE_REF)
 	ZEND_VM_NEXT_OPCODE();
 }
 
+ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_VERIFY_RETURN_TYPE, (((res_info & MAY_BE_REF) == 0) && op1_info == MAY_BE_STRING), ZEND_VERIFY_RETURN_TYPE_FOR_STRING, CONST|TMPVAR|CV, UNUSED)
+{
+	USE_OPLINE
+	zval *retval_ptr = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
+	uint32_t pure_type_mask = opline->extended_value;
+
+	zend_string *str = Z_STR_P(retval_ptr);
+	if (OP1_TYPE == IS_CONST) {
+		ZVAL_COPY(EX_VAR(opline->result.var), retval_ptr);
+		retval_ptr = EX_VAR(opline->result.var);
+	}
+
+	if (pure_type_mask & MAY_BE_STRING) {
+		ZEND_VM_NEXT_OPCODE();
+	}
+
+	if (UNEXPECTED(EX_USES_STRICT_TYPES() || ((pure_type_mask & (MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_BOOL)) == 0))) {
+		SAVE_OPLINE();
+		zend_verify_return_error(EX(func), retval_ptr);
+		HANDLE_EXCEPTION();
+	}
+
+	/* Type preference order: int -> float -> bool */
+	zend_long lval = 0;
+	double dval = 0;
+	uint8_t type = is_numeric_str_function(str, &lval, &dval);
+	if (type == IS_LONG) {
+		zend_string_release(str);
+		if (pure_type_mask & MAY_BE_LONG) {
+			ZVAL_LONG(retval_ptr, lval);
+		} else if (pure_type_mask & MAY_BE_DOUBLE) {
+			ZVAL_DOUBLE(retval_ptr, (double)lval);
+		} else {
+			ZEND_ASSERT(pure_type_mask & MAY_BE_BOOL);
+			ZVAL_BOOL(retval_ptr, lval);
+		}
+		ZEND_VM_NEXT_OPCODE();
+	} else if (type == IS_DOUBLE) {
+		if (pure_type_mask & MAY_BE_DOUBLE) {
+			zend_string_release(str);
+			ZVAL_DOUBLE(retval_ptr, dval);
+			ZEND_VM_NEXT_OPCODE();
+		} else if (pure_type_mask & MAY_BE_LONG) {
+			if (!zend_isnan(dval) && ZEND_DOUBLE_FITS_LONG(dval)) {
+				lval = zend_dval_to_lval(dval);
+				SAVE_OPLINE();
+				if (UNEXPECTED(!zend_is_long_compatible(dval, lval))) {
+					zend_incompatible_string_to_long_error(str);
+					zend_string_release(str);
+				}
+				zend_string_release(str);
+				ZVAL_LONG(retval_ptr, lval);
+				ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+			}
+		} else {
+			zend_string_release(str);
+			ZVAL_BOOL(retval_ptr, dval);
+			ZEND_VM_NEXT_OPCODE();
+		}
+	} else {
+		if (pure_type_mask & MAY_BE_BOOL) {
+			ZVAL_BOOL(retval_ptr, i_zend_is_true(retval_ptr));
+			zend_string_release(str);
+			ZEND_VM_NEXT_OPCODE();
+		}
+	}
+	SAVE_OPLINE();
+	zend_verify_return_error(EX(func), retval_ptr);
+	HANDLE_EXCEPTION();
+}
+
 ZEND_VM_COLD_HANDLER(201, ZEND_VERIFY_NEVER_TYPE, UNUSED, UNUSED)
 {
 	SAVE_OPLINE();