Skip to content

Commit 3d6a7e2

Browse files
committed
JIT: Fix missing exception handling
Fixes oss-fuzz #45649
1 parent d0417eb commit 3d6a7e2

File tree

2 files changed

+34
-1
lines changed

2 files changed

+34
-1
lines changed

ext/opcache/jit/zend_jit_trace.c

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5843,7 +5843,16 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
58435843
}
58445844

58455845
if (opline->opcode != ZEND_NOP && opline->opcode != ZEND_JMP) {
5846-
if (!zend_jit_trace_handler(&dasm_state, op_array, opline, zend_may_throw(opline, ssa_op, op_array, ssa), p + 1)) {
5846+
op1_info = OP1_INFO();
5847+
op2_info = OP2_INFO();
5848+
if (op1_info & MAY_BE_GUARD) {
5849+
op1_info = MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
5850+
}
5851+
if (op2_info & MAY_BE_GUARD) {
5852+
op2_info = MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
5853+
}
5854+
if (!zend_jit_trace_handler(&dasm_state, op_array, opline,
5855+
zend_may_throw_ex(opline, ssa_op, op_array, ssa, op1_info, op2_info), p + 1)) {
58475856
goto jit_failure;
58485857
}
58495858
}

ext/opcache/tests/jit/bw_not_002.phpt

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
--TEST--
2+
JIT BW_NOT: 002 Exception handling
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.file_update_protection=0
7+
opcache.jit_buffer_size=1M
8+
opcache.protect_memory=1
9+
--FILE--
10+
<?php
11+
function test() {
12+
$j = 0;
13+
for ($i = 0; $i < 10; $i++) {
14+
$a = ~$j - $a = $j + $j = !$j = $j++;
15+
}
16+
}
17+
test();
18+
?>
19+
--EXPECTF--
20+
Fatal error: Uncaught TypeError: Cannot perform bitwise not on bool in %sbw_not_002.php:5
21+
Stack trace:
22+
#0 %sbw_not_002.php(8): test()
23+
#1 {main}
24+
thrown in %sbw_not_002.php on line 5

0 commit comments

Comments
 (0)