Fixed Bug #81255 (Memory leak in PHPUnit with functional JIT)

Author: dstogov

NEWS

@@ -19,6 +19,7 @@ PHP                                                                        NEWS
   . Fixed bug #81206 (Multiple PHP processes crash with JIT enabled). (cmb,
     Nikita)
   . Fixed bug #81272 (Segfault in var[] after array_slice with JIT). (Nikita)
+  . Fixed Bug #81255 (Memory leak in PHPUnit with functional JIT). (Dmitry)
 
 - Standard:
   . Fixed bug #72146 (Integer overflow on substr_replace). (cmb)

ext/opcache/jit/zend_jit_x86.dasc

@@ -13610,7 +13610,7 @@ static int zend_jit_assign_obj_op(dasm_State          **Dst,
 				}
 				if (((opline+1)->op1_type & (IS_VAR|IS_TMP_VAR))
 				 && (val_info & (MAY_BE_REF|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE))) {
-					|	jmp >8
+					|	jmp >7
 				} else {
 					|	jmp ->exception_handler
 				}
@@ -14029,7 +14029,7 @@ static int zend_jit_assign_obj(dasm_State          **Dst,
 
 			if (((opline+1)->op1_type & (IS_VAR|IS_TMP_VAR))
 			 && (val_info & (MAY_BE_REF|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE))) {
-				|	jmp >8
+				|	jmp >7
 			} else {
 				|	jmp >9
 			}
@@ -14159,7 +14159,7 @@ static int zend_jit_assign_obj(dasm_State          **Dst,
 			val_info |= MAY_BE_RC1|MAY_BE_RCN;
 		}
 
-		|8:
+		|7:
 		|	// FREE_OP_DATA();
 		|	FREE_OP (opline+1)->op1_type, (opline+1)->op1, val_info, 0, opline
 		|	jmp >9

ext/opcache/tests/jit/bug81255.phpt

@@ -0,0 +1,31 @@
+--TEST--
+Bug #81255: Memory leak in PHPUnit with functional JIT
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit_buffer_size=1M
+opcache.jit=function
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+eval('class B {}');
+class A extends B {
+    private ?string $x = null;
+
+    public function foo($a) {
+        if (!($this->x = str_repeat($a, 5))) {
+	        throw new Exception('ops');
+        }
+        var_dump($this->x);
+        $this->x = null;
+    }
+}
+
+$a = new A;
+$a->foo('a');
+$a->foo('b');
+?>
+--EXPECT--
+string(5) "aaaaa"
+string(5) "bbbbb"