Zend: add VM spec for ZEND_VERIFY_TYPE_RETURN for string values

Author: Girgias

Zend/zend_vm_def.h

@@ -4568,6 +4568,75 @@ ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_VERIFY_RETURN_TYPE, (((res_info & MAY_BE_REF)
 	ZEND_VM_NEXT_OPCODE();
 }
 
+ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_VERIFY_RETURN_TYPE, (((res_info & MAY_BE_REF) == 0) && op1_info == MAY_BE_STRING), ZEND_VERIFY_RETURN_TYPE_FOR_STRING, CONST|TMP|VAR|CV, UNUSED)
+{
+	USE_OPLINE
+	zval *op, *result;
+	uint32_t pure_type_mask = opline->extended_value;
+
+	if (UNEXPECTED(EX_USES_STRICT_TYPES() || ((pure_type_mask & MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_BOOL) == 0))) {
+		SAVE_OPLINE();
+		zend_verify_return_error(EX(func), result);
+		HANDLE_EXCEPTION();
+	}
+
+	op = GET_OP1_ZVAL_PTR(BP_VAR_R);
+	result = EX_VAR(opline->result.var);
+
+	/* Would have been elided by optimizer */
+	ZEND_ASSERT((pure_type_mask & MAY_BE_STRING) == 0);
+
+	/* Type preference order: int -> float -> bool */
+	zend_long lval = 0;
+	double dval = 0;
+	uint8_t type = is_numeric_str_function(Z_STR_P(op), &lval, &dval);
+	if (type == IS_LONG) {
+		if (pure_type_mask & MAY_BE_LONG) {
+			ZVAL_LONG(result, lval);
+		} else if (pure_type_mask & MAY_BE_DOUBLE) {
+			ZVAL_DOUBLE(result, (double)lval);
+		} else {
+			ZEND_ASSERT(pure_type_mask & MAY_BE_BOOL);
+			ZVAL_BOOL(result, lval);
+		}
+		ZEND_VM_NEXT_OPCODE();
+	} else if (type == IS_DOUBLE) {
+		if (pure_type_mask & MAY_BE_DOUBLE) {
+			ZVAL_DOUBLE(result, dval);
+			ZEND_VM_NEXT_OPCODE();
+		} else if (pure_type_mask & MAY_BE_LONG) {
+			if (!zend_isnan(dval) && ZEND_DOUBLE_FITS_LONG(dval)) {
+				SAVE_OPLINE();
+				/* May warn */
+				ZVAL_LONG(result, zend_dval_to_lval_safe(dval));
+				ZEND_VM_NEXT_OPCODE();
+			}
+		} else {
+			ZVAL_BOOL(result, dval);
+			ZEND_VM_NEXT_OPCODE();
+		}
+	} else {
+		if (pure_type_mask & MAY_BE_BOOL) {
+			ZVAL_BOOL(result, i_zend_is_true(op));
+			ZEND_VM_NEXT_OPCODE();
+		}
+	}
+	SAVE_OPLINE();
+	zend_verify_return_error(EX(func), op);
+	HANDLE_EXCEPTION();
+	/* int to float is always valid even with strict types */
+	if (pure_type_mask & MAY_BE_LONG) {
+		ZVAL_LONG(result, lval);
+		ZEND_VM_NEXT_OPCODE();
+	} else if (pure_type_mask & MAY_BE_DOUBLE) {
+		ZVAL_DOUBLE(result, (double)lval);
+		ZEND_VM_NEXT_OPCODE();
+	} else if (pure_type_mask & MAY_BE_BOOL) {
+		ZVAL_BOOL(result, lval);
+	} else {
+	}
+}
+
 ZEND_VM_COLD_HANDLER(201, ZEND_VERIFY_NEVER_TYPE, UNUSED, UNUSED)
 {
 	SAVE_OPLINE();