php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix missing reference unwrap for FE_FETCH_R in JIT (GH-21265)

Browse Source 
Fixes GH-21264
This commit is contained in:
Ilija Tovilo
2026-02-24 02:15:07 +01:00
committed by GitHub
parent 3bf7d9a7d6
commit db0e365f5a
3 changed files with 85 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
ext/opcache/jit/zend_jit_ir.c
View File

@@ -14105,6 +14105,13 @@ static int zend_jit_fe_fetch(zend_jit_ctx *jit, const zend_op *opline, uint32_t
return 0;
}
} else {
// JIT: ZVAL_DEREF(value);
if (val_info & MAY_BE_REF) {
ir_ref ref = jit_ZVAL_ADDR(jit, val_addr);
ref = jit_ZVAL_DEREF_ref(jit, ref);
val_addr = ZEND_ADDR_REF_ZVAL(ref);
val_info &= ~MAY_BE_REF;
}
// JIT: ZVAL_COPY(res, value);
jit_ZVAL_COPY(jit, var_addr, -1, val_addr, val_info, true);
}

47
ext/opcache/tests/jit/gh21264-1.phpt Normal file
View File

@@ -0,0 +1,47 @@
--TEST--
GH-21264: Missing reference unwrap for FE_FETCH_R in JIT
--EXTENSIONS--
opcache
--INI--
opcache.enable=1
opcache.enable_cli=1
opcache.jit=function
--FILE--
<?php
class C {
public array $array;
public static function identity($x) {
return $x;
}
public function test() {
return array_map(self::identity(...), $this->array);
}
}
function test() {
$c = new C;
$element = 'qux';
$c->array = [&$element, &$element];
var_dump($c->test());
}
test();
test();
?>
--EXPECT--
array(2) {
[0]=>
string(3) "qux"
[1]=>
string(3) "qux"
}
array(2) {
[0]=>
string(3) "qux"
[1]=>
string(3) "qux"
}

31
ext/opcache/tests/jit/gh21264-2.phpt Normal file
View File

@@ -0,0 +1,31 @@
--TEST--
GH-21264: Missing reference unwrap for FE_FETCH_R in JIT
--EXTENSIONS--
opcache
--INI--
opcache.enable=1
opcache.enable_cli=1
opcache.jit=tracing
--FILE--
<?php
class C {
public $prop = 0;
}
function test($array) {
$c = new C;
foreach ($array as $c->prop) {
$c->prop++;
}
}
$element = 0;
$array = [&$element, &$element];
test($array);
test($array);
var_dump($element);
?>
--EXPECT--
int(0)