diff --git a/ext/opcache/jit/zend_jit_arm64.dasc b/ext/opcache/jit/zend_jit_arm64.dasc index f61dbc447be..ae71ee04058 100644 --- a/ext/opcache/jit/zend_jit_arm64.dasc +++ b/ext/opcache/jit/zend_jit_arm64.dasc @@ -12923,12 +12923,12 @@ static int zend_jit_assign_obj_op(dasm_State **Dst, } else { | EXT_CALL zend_jit_invalid_property_assign, REG0 } + may_throw = 1; if (((opline+1)->op1_type & (IS_VAR|IS_TMP_VAR)) && (val_info & (MAY_BE_REF|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE))) { - may_throw = 1; | b >8 } else { - | b ->exception_handler + | b >9 } |.code } @@ -13296,7 +13296,7 @@ static int zend_jit_assign_obj(dasm_State **Dst, && (val_info & (MAY_BE_REF|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE))) { | b >7 } else { - | b ->exception_handler + | b >9 } |.code } diff --git a/ext/opcache/jit/zend_jit_x86.dasc b/ext/opcache/jit/zend_jit_x86.dasc index b600d6691df..c07d1ae3bf8 100644 --- a/ext/opcache/jit/zend_jit_x86.dasc +++ b/ext/opcache/jit/zend_jit_x86.dasc @@ -13667,12 +13667,13 @@ static int zend_jit_assign_obj_op(dasm_State **Dst, } else { | EXT_CALL zend_jit_invalid_property_assign, r0 } + may_throw = 1; if (((opline+1)->op1_type & (IS_VAR|IS_TMP_VAR)) && (val_info & (MAY_BE_REF|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE))) { may_throw = 1; | jmp >8 } else { - | jmp ->exception_handler + | jmp >9 } |.code } @@ -14081,7 +14082,7 @@ static int zend_jit_assign_obj(dasm_State **Dst, && (val_info & (MAY_BE_REF|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE))) { | jmp >7 } else { - | jmp ->exception_handler + | jmp >9 } |.code } diff --git a/ext/opcache/tests/jit/assign_obj_on_null.phpt b/ext/opcache/tests/jit/assign_obj_on_null.phpt new file mode 100644 index 00000000000..16992727c90 --- /dev/null +++ b/ext/opcache/tests/jit/assign_obj_on_null.phpt @@ -0,0 +1,37 @@ +--TEST-- +ASSIGN_OBJ on null reference returned from __get() +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.file_update_protection=0 +opcache.jit_buffer_size=1M +--FILE-- +prop; + } +} +function test() { + $obj = new Test; + $obj->x->y = 1; +} +function test2() { + $obj = new Test; + $obj->x->y += 1; +} +try { + test(); +} catch (Error $e) { + echo $e->getMessage(), "\n"; +} +try { + test2(); +} catch (Error $e) { + echo $e->getMessage(), "\n"; +} +?> +--EXPECT-- +Attempt to assign property "y" on null +Attempt to assign property "y" on null