From e862dc5cd8f4c86c3d761b507b22ef0da0576eb0 Mon Sep 17 00:00:00 2001
From: Mark Williams <mwilliams@fb.com>
Date: Thu, 16 Mar 2017 12:41:45 -0700
Subject: [PATCH] Explicitly check for non-empty arrays before creating them.

Summary:
DataTag::ArrayLikePacked is only used for Vecs, Dicts, and Arrays. But
it can be used with maybe-empty Vecs, Dicts and Arrays, so we need a
final else-if.

Reviewed By: kodafb

Differential Revision: D4721787

fbshipit-source-id: 15704b6f7422b11e73dc1210f7a4bb99f1b6b547
---
 hphp/hhbbc/type-system.cpp                        |  3 ++-
 hphp/test/slow/vec/bad-type-conversion.php        | 28 +++++++++++++++++++++++
 hphp/test/slow/vec/bad-type-conversion.php.expect |  5 ++++
 3 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 hphp/test/slow/vec/bad-type-conversion.php
 create mode 100644 hphp/test/slow/vec/bad-type-conversion.php.expect

diff --git a/hphp/hhbbc/type-system.cpp b/hphp/hhbbc/type-system.cpp
index 2805dbf97b7..c7ee854b417 100644
--- a/hphp/hhbbc/type-system.cpp
+++ b/hphp/hhbbc/type-system.cpp
@@ -1958,9 +1958,10 @@ folly::Optional<Cell> tv(const Type& t) {
         return fromTypeVec<VecArrayInit>(t.m_data.packed->elems);
       } else if ((t.m_bits & BDictN) == t.m_bits) {
         return fromTypeVec<DictInit>(t.m_data.packed->elems);
-      } else {
+      } else if ((t.m_bits & BArrN) == t.m_bits) {
         return fromTypeVec<PackedArrayInit>(t.m_data.packed->elems);
       }
+      break;
     case DataTag::RefInner:
     case DataTag::ArrLikePackedN:
     case DataTag::ArrLikeMapN:
diff --git a/hphp/test/slow/vec/bad-type-conversion.php b/hphp/test/slow/vec/bad-type-conversion.php
new file mode 100644
index 00000000000..274017aafe7
--- /dev/null
+++ b/hphp/test/slow/vec/bad-type-conversion.php
@@ -0,0 +1,28 @@
+<?hh
+
+async function foo() {
+  static $x = false; $x = !$x; return $x;
+}
+
+class X {
+  public async function f() {
+    $buckets = vec[];
+
+    $foo = await foo();
+    if ($foo) {
+      $buckets[] = "hello";
+    }
+
+    return $this->g($buckets);
+  }
+
+  public function g(vec $v) { return $v; }
+}
+
+function test() {
+  $x = new X;
+  var_dump(HH\Asio\join($x->f()));
+  var_dump(HH\Asio\join($x->f()));
+}
+
+test();
diff --git a/hphp/test/slow/vec/bad-type-conversion.php.expect b/hphp/test/slow/vec/bad-type-conversion.php.expect
new file mode 100644
index 00000000000..c38cf5a0e34
--- /dev/null
+++ b/hphp/test/slow/vec/bad-type-conversion.php.expect
@@ -0,0 +1,5 @@
+vec(1) {
+  string(5) "hello"
+}
+vec(0) {
+}
-- 
2.11.4.GIT