@@ -132,11 +132,9 @@ inline zv::Val valueFlowContext(zval *context, zval *valueFlowWrite)
132132 return pt_expression_context_enter_value_flow (deep.raw (), valueFlowWrite, false );
133133}
134134
135- /* VariableFlow::sequence($varResult->getVariableFlow(), $valueFlowWrite !==
136- * null && $context->isValueConsumed() ? VariableFlow::inputs($valueFlowWrite->getId(),
137- * $context->getValueFlowTarget() !== null ? $context->getValueFlowTarget()->getId() : null)
138- * : null, VariableFlowBuilder::targetWrite($var, $kind, $assignedScope, $storage)) */
139- inline zv::Val incDecFlow (zval *varFlow, zval *valueFlowWrite, zval *context, zval *var, zend_long kind, zval *assignedScope, zval *storage)
135+ /* Post-inc/dec consumes the inputs of the write; pre-inc/dec consumes the
136+ * newly written value, so its target read must follow the target write. */
137+ inline zv::Val incDecFlow (zval *varFlow, zval *valueFlowWrite, zval *context, zval *var, zend_long kind, zval *assignedScope, zval *storage, bool readsNewValue = false )
140138{
141139 zv::Val inputsFlow = zv::Val::null ();
142140 if (Z_TYPE_P (valueFlowWrite) != IS_NULL ) {
@@ -154,13 +152,15 @@ inline zv::Val incDecFlow(zval *varFlow, zval *valueFlowWrite, zval *context, zv
154152 targetId = variableWriteId (target.raw ());
155153 if (UNEXPECTED (targetId.isUndef ())) return zv::Val ();
156154 }
157- inputsFlow = pt_variable_flow_inputs (zval_get_long (writeId.raw ()), targetId.raw ());
155+ inputsFlow = readsNewValue
156+ ? pt_variable_flow_builder_target_read (var, storage, true , targetId.raw ())
157+ : pt_variable_flow_inputs (zval_get_long (writeId.raw ()), targetId.raw ());
158158 if (UNEXPECTED (inputsFlow.isUndef ())) return zv::Val ();
159159 }
160160 }
161161 zv::Val targetWriteFlow = pt_variable_flow_builder_target_write (var, kind, assignedScope, storage, NULL );
162162 if (UNEXPECTED (targetWriteFlow.isUndef ())) return zv::Val ();
163- zv::Args flows{varFlow, inputsFlow.raw (), targetWriteFlow.raw ()};
163+ zv::Args flows{varFlow, readsNewValue ? targetWriteFlow. raw () : inputsFlow.raw (), readsNewValue ? inputsFlow. raw () : targetWriteFlow.raw ()};
164164 return pt_variable_flow_sequence (3 , flows);
165165}
166166
0 commit comments