php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fixed code generation for CMP

Browse Source 
Fixes oss-fuzz #63569
This commit is contained in:
Dmitry Stogov
2023-10-25 12:38:46 +03:00
parent c163ff68da
commit c2b704b63e
2 changed files with 58 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ext/opcache/jit/zend_jit_ir.c
View File

@@ -6952,6 +6952,10 @@ static int zend_jit_cmp(zend_jit_ctx *jit,
} else {
ir_MERGE_N(n, end_inputs->refs);
}
} else if (smart_branch_opcode && !exit_addr) {
/* dead code */
_zend_jit_add_predecessor_ref(jit, target_label, jit->b, ir_END());
jit->b = -1;
}
return 1;

54
ext/opcache/tests/jit/cmp_009.phpt Normal file
View File

@@ -0,0 +1,54 @@
--TEST--
JIT CMP: 009 Wrong code generation for dead compare
--INI--
opcache.enable=1
opcache.enable_cli=1
opcache.file_update_protection=0
opcache.jit_buffer_size=1M
--FILE--
<?php
function test() {
$j = 0;
for ($i = 0; $i < 20; $j++) {
$a&=
$a = $a.+
$tojenthiss[$i = $v] = $s=
$tojenthiss[$i = $v] = $s=
$a&=
$b =
$b =
$a = $a.+
$obj->prop =
$a = $a.+
$obj->prop =
$a = $a.+
$Sojenthiss[$i = $v] = $s=
$x!= $a ?: $c;
$x!= $a ?: $c;
$x!= $a ?: $c;
$x!= $a ?: $c;
$aZ = $a;
$aZ = $a;
$aZ = $a;
$a = $a.+
$a = $a.+
$x!= $a ?: $c;
$aZ = $a;
$a = $a.+
$a = $a.+
$obj->prop =
$a = $a.+
$Sojenthiss[$i = $v] = $s=
$x!= $a ?: $c;
$x!= $a ?: $c;
$aZ = $a;
}
}
@test();
?>
--EXPECTF--
Fatal error: Uncaught Error: Attempt to assign property "prop" on null in %scmp_009.php:15
Stack trace:
#0 %scmp_009.php(39): test()
#1 {main}
thrown in %scmp_009.php on line 15