Check open integer-range bounds for shift-left overflow (#6647)

Author: JanTvrdik

src/Reflection/InitializerExprTypeResolver.php

@@ -2618,9 +2618,10 @@ private function integerRangeMath(Type $range, BinaryOp $node, Type $operand): T
 				return new ErrorType();
 			}
 			// an overflowing shift wraps around, which breaks the monotonicity the bounds rely on
+			// open bounds still include the platform's minimum or maximum integer
 			if (
-				($rangeMin !== null && self::shiftLeftOverflows(intval($rangeMin), $operand->getValue()))
-				|| ($rangeMax !== null && self::shiftLeftOverflows(intval($rangeMax), $operand->getValue()))
+				self::shiftLeftOverflows($rangeMin ?? PHP_INT_MIN, $operand->getValue())
+				|| self::shiftLeftOverflows($rangeMax ?? PHP_INT_MAX, $operand->getValue())
 			) {
 				return new IntegerType();
 			}

src/Turbo/TurboExtensionEnabler.php

@@ -33,7 +33,7 @@
 final class TurboExtensionEnabler
 {
 
-	public const EXPECTED_EXTENSION_VERSION = 'f46d060';
+	public const EXPECTED_EXTENSION_VERSION = 'a0f7086';
 
 	private static bool $active = false;
 

tests/PHPStan/Analyser/nsrt/integer-range-types.php

@@ -364,8 +364,8 @@ public function shiftLeft($a, $b, $c, $d, $e, $f): void
 		assertType('*ERROR*', $f << 0);
 
 		assertType('int<-10, 10>', $a << 1);
-		assertType('int<10, max>', $b << 1);
-		assertType('int<min, -10>', $c << 1);
+		assertType('int', $b << 1);
+		assertType('int', $c << 1);
 		assertType('2|50|int<10, 20>|int<60, 80>', $d << 1);
 		assertType('2|6|10', $e << 1);
 		assertType('*ERROR*', $f << 1);

tests/PHPStan/Analyser/nsrt/shift-left-unbounded-range.php

@@ -0,0 +1,55 @@
+<?php declare(strict_types = 1);
+
+namespace ShiftLeftUnboundedRange;
+
+use RuntimeException;
+use function PHPStan\Testing\assertType;
+
+/**
+ * @param non-negative-int $nonNegative
+ * @param positive-int $positive
+ * @param int<min, 0> $nonPositive
+ * @param negative-int $negative
+ * @param int<min, 10> $unboundedMin
+ * @param int<-10, max> $unboundedMax
+ */
+function shiftRanges(int $nonNegative, int $positive, int $nonPositive, int $negative, int $unboundedMin, int $unboundedMax): void
+{
+	assertType('int', $nonNegative << 1);
+	assertType('int', $positive << 1);
+	assertType('int', $nonPositive << 1);
+	assertType('int', $negative << 1);
+	assertType('int', $unboundedMin << 1);
+	assertType('int', $unboundedMax << 1);
+
+	assertType('int<0, max>', $nonNegative << 0);
+	assertType('int<1, max>', $positive << 0);
+	assertType('int<min, 0>', $nonPositive << 0);
+	assertType('int<min, -1>', $negative << 0);
+	assertType('int<min, 10>', $unboundedMin << 0);
+	assertType('int<-10, max>', $unboundedMax << 0);
+
+	assertType('int<0, max>', $nonNegative >> 1);
+	assertType('int<0, max>', $positive >> 1);
+	assertType('int<min, 0>', $nonPositive >> 1);
+	assertType('int<min, -1>', $negative >> 1);
+	assertType('int<min, 5>', $unboundedMin >> 1);
+	assertType('int<-5, max>', $unboundedMax >> 1);
+}
+
+function readU64(string $bytes): int
+{
+	$value = 0;
+	for ($i = 0; $i < 8; $i++) {
+		$value = ($value << 8) | ord($bytes[$i]);
+	}
+
+	assertType('int', $value);
+	assertType('bool', $value < 0);
+	if ($value < 0) {
+		throw new RuntimeException('Value is too large for 64-bit signed integer');
+	}
+
+	assertType('int<0, max>', $value);
+	return $value;
+}

tests/PHPStan/Rules/Comparison/NumberComparisonOperatorsConstantConditionRuleTest.php

@@ -327,4 +327,9 @@ public function testBug15243(): void
 		$this->analyse([__DIR__ . '/../../Analyser/nsrt/bug-15243.php'], []);
 	}
 
+	public function testShiftLeftUnboundedRange(): void
+	{
+		$this->analyse([__DIR__ . '/../../Analyser/nsrt/shift-left-unbounded-range.php'], []);
+	}
+
 }

turbo-ext/src/InitializerExprTypeResolver.cpp

@@ -3034,10 +3034,11 @@ class InitializerExprTypeResolver
 				}
 				if (kind == IETR_SHIFT_LEFT) {
 					// an overflowing shift wraps around, which breaks the monotonicity the bounds rely on
+					// open bounds still include the platform's minimum or maximum integer
 					bool minOverflows = false;
 					bool maxOverflows = false;
-					if (Z_TYPE(rangeMin) != IS_NULL && UNEXPECTED(!shiftLeftOverflows(zval_get_long(&rangeMin), operandValue, minOverflows))) return zv::Val();
-					if (!minOverflows && Z_TYPE(rangeMax) != IS_NULL && UNEXPECTED(!shiftLeftOverflows(zval_get_long(&rangeMax), operandValue, maxOverflows))) return zv::Val();
+					if (UNEXPECTED(!shiftLeftOverflows(Z_TYPE(rangeMin) == IS_NULL ? ZEND_LONG_MIN : zval_get_long(&rangeMin), operandValue, minOverflows))) return zv::Val();
+					if (!minOverflows && UNEXPECTED(!shiftLeftOverflows(Z_TYPE(rangeMax) == IS_NULL ? ZEND_LONG_MAX : zval_get_long(&rangeMax), operandValue, maxOverflows))) return zv::Val();
 					if (minOverflows || maxOverflows) {
 						return newIntegerType();
 					}

turbo-ext/tests/type-family.php

@@ -7741,6 +7741,13 @@ public function getResolvedPhpDoc(): ?\PHPStan\PhpDoc\ResolvedPhpDocBlock { retu
 			}
 		}
 	}
+	foreach ([[0, null], [1, null], [null, 0], [null, -1], [null, 10], [-10, null]] as $i => [$min, $max]) {
+		foreach ([0, 1, 8, 12] as $shift) {
+			foreach (['getShiftLeftType', 'getShiftRightType'] as $method) {
+				$r["$method open range $i shift $shift"] = $catching(static fn () => $resolver->$method($te($range($min, $max)), $te($int($shift)), $getType));
+			}
+		}
+	}
 	foreach ($operands as $leftName => $left) {
 		foreach ($operands as $rightName => $right) {
 			$r["resolveIdenticalType $leftName $rightName"] = $catching(static fn () => $viewResult($resolver->resolveIdenticalType($left, $right)));