php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-18899: JIT function crash when emitting undefined variable warning and opline is not set yet

Browse Source 
The crash happens because EX(opline) is attempted to be accessed but
it's not set yet.

Closes GH-18904.
This commit is contained in:
Niels Dossche
2025-06-22 09:43:08 +02:00
parent ee2c0d7e7f
commit 56c4ddfaf6
3 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -24,6 +24,8 @@ PHP NEWS
- Opcache:
. Fixed bug GH-18639 (Internal class aliases can break preloading + JIT).
(nielsdos)
. Fixed bug GH-18899 (JIT function crash when emitting undefined variable
warning and opline is not set yet). (nielsdos)
- Standard:
. Fix misleading errors in printf(). (nielsdos)

2
ext/opcache/jit/zend_jit_ir.c
View File

@@ -5981,6 +5981,7 @@ static int zend_jit_long_math_helper(zend_jit_ctx *jit,
ir_IF_FALSE_cold(if_def);
// zend_error_unchecked(E_WARNING, "Undefined variable $%S", CV_DEF_OF(EX_VAR_TO_NUM(opline->op1.var)));
jit_SET_EX_OPLINE(jit, opline);
ir_CALL_1(IR_VOID, ir_CONST_FC_FUNC(zend_jit_undefined_op_helper), ir_CONST_U32(opline->op1.var));
ref2 = jit_EG(uninitialized_zval);
@@ -5997,6 +5998,7 @@ static int zend_jit_long_math_helper(zend_jit_ctx *jit,
ir_IF_FALSE_cold(if_def);
// zend_error_unchecked(E_WARNING, "Undefined variable $%S", CV_DEF_OF(EX_VAR_TO_NUM(opline->op2.var)));
jit_SET_EX_OPLINE(jit, opline);
ir_CALL_1(IR_VOID, ir_CONST_FC_FUNC(zend_jit_undefined_op_helper), ir_CONST_U32(opline->op2.var));
ref2 = jit_EG(uninitialized_zval);

21
ext/opcache/tests/jit/gh18899.phpt Normal file
View File

@@ -0,0 +1,21 @@
--TEST--
GH-18899 (JIT function crash when emitting undefined variable warning and opline is not set yet)
--EXTENSIONS--
opcache
--INI--
opcache.enable=1
opcache.enable_cli=1
opcache.jit=1205
opcache.jit_buffer_size=8M
--FILE--
<?php
function ptr2str()
{
for ($i=0; $i<8; $i++) {
$ptr >>= 8;
}
}
str_repeat("A",232).ptr2str();
?>
--EXPECTF--
Warning: Undefined variable $ptr in %s on line %d