php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.5'

Browse Source 
* PHP-8.5:
  Fix OSS-Fuzz #478009707 for JIT
This commit is contained in:
Ilija Tovilo
2026-02-08 16:47:06 +01:00
parent 52e9436629 ba6df41144
commit fcb50e4d62
2 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
Zend/tests/oss-fuzz-478009707.phpt
View File

@@ -18,6 +18,10 @@ $c = new C(1);
$c->prop = 1;
var_dump($c->prop);
$c->prop = PHP_INT_MAX;
var_dump($c->prop);
?>
--EXPECT--
--EXPECTF--
int(4)
float(%s)

14
ext/opcache/jit/zend_jit_helpers.c
View File

@@ -2944,7 +2944,7 @@ static void ZEND_FASTCALL zend_jit_assign_obj_op_helper(zend_object *zobj, zend_
//??? } else {
//??? prop_info = zend_object_fetch_property_type_info(Z_OBJ_P(object), orig_zptr);
//??? }
if (prop_info) {
if (prop_info && ZEND_TYPE_IS_SET(prop_info->type)) {
/* special case for typed properties */
zend_jit_assign_op_to_typed_prop(zptr, prop_info, value, binary_op);
} else {
@@ -3140,6 +3140,9 @@ static void ZEND_FASTCALL zend_jit_pre_inc_obj_helper(zend_object *zobj, zend_st
}
} else {
zend_property_info *prop_info = (zend_property_info *) CACHED_PTR_EX(cache_slot + 2);
if (prop_info && !ZEND_TYPE_IS_SET(prop_info->type)) {
prop_info = NULL;
}
if (EXPECTED(Z_TYPE_P(prop) == IS_LONG)) {
fast_long_increment_function(prop);
@@ -3210,6 +3213,9 @@ static void ZEND_FASTCALL zend_jit_pre_dec_obj_helper(zend_object *zobj, zend_st
}
} else {
zend_property_info *prop_info = (zend_property_info *) CACHED_PTR_EX(cache_slot + 2);
if (prop_info && !ZEND_TYPE_IS_SET(prop_info->type)) {
prop_info = NULL;
}
if (EXPECTED(Z_TYPE_P(prop) == IS_LONG)) {
fast_long_decrement_function(prop);
@@ -3278,6 +3284,9 @@ static void ZEND_FASTCALL zend_jit_post_inc_obj_helper(zend_object *zobj, zend_s
ZVAL_NULL(result);
} else {
zend_property_info *prop_info = (zend_property_info*)CACHED_PTR_EX(cache_slot + 2);
if (prop_info && !ZEND_TYPE_IS_SET(prop_info->type)) {
prop_info = NULL;
}
if (EXPECTED(Z_TYPE_P(prop) == IS_LONG)) {
ZVAL_LONG(result, Z_LVAL_P(prop));
@@ -3339,6 +3348,9 @@ static void ZEND_FASTCALL zend_jit_post_dec_obj_helper(zend_object *zobj, zend_s
ZVAL_NULL(result);
} else {
zend_property_info *prop_info = (zend_property_info*)CACHED_PTR_EX(cache_slot + 2);
if (prop_info && !ZEND_TYPE_IS_SET(prop_info->type)) {
prop_info = NULL;
}
if (EXPECTED(Z_TYPE_P(prop) == IS_LONG)) {
ZVAL_LONG(result, Z_LVAL_P(prop));