Skip to content

Commit f8d2e00

Browse files
authored
Fix GH-17190: Assertion failure ext/opcache/jit/ir/ir_gcm.c (#17221)
1 parent 73857e6 commit f8d2e00

File tree

2 files changed

+47
-0
lines changed

2 files changed

+47
-0
lines changed

ext/opcache/jit/zend_jit_ir.c

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13380,6 +13380,14 @@ static int zend_jit_assign_dim_op(zend_jit_ctx *jit,
1338013380

1338113381
op1_addr = zend_jit_prepare_array_update(jit, opline, op1_info, op1_addr, &if_type, &ht_ref, &may_throw);
1338213382

13383+
if (Z_MODE(op3_addr) == IS_REG
13384+
&& Z_LOAD(op3_addr)
13385+
&& jit->ra[Z_SSA_VAR(op3_addr)].ref == IR_NULL) {
13386+
/* Force load */
13387+
zend_jit_use_reg(jit, op3_addr);
13388+
}
13389+
13390+
1338313391
if (op1_info & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_ARRAY)) {
1338413392
uint32_t var_def_info = zend_array_element_type(op1_def_info, opline->op1_type, 1, 0);
1338513393

@@ -15015,6 +15023,13 @@ static int zend_jit_assign_obj_op(zend_jit_ctx *jit,
1501515023
&& prop_type != IS_REFERENCE
1501615024
&& (op1_info & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_OBJECT);
1501715025

15026+
if (Z_MODE(val_addr) == IS_REG
15027+
&& Z_LOAD(val_addr)
15028+
&& jit->ra[Z_SSA_VAR(val_addr)].ref == IR_NULL) {
15029+
/* Force load */
15030+
zend_jit_use_reg(jit, val_addr);
15031+
}
15032+
1501815033
if (!prop_info) {
1501915034
ir_ref run_time_cache = ir_LOAD_A(jit_EX(run_time_cache));
1502015035
ir_ref ref = ir_LOAD_A(ir_ADD_OFFSET(run_time_cache, (opline+1)->extended_value & ~ZEND_FETCH_OBJ_FLAGS));

ext/opcache/tests/jit/gh17190.phpt

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
--TEST--
2+
GH-17190 (Assertion failure ext/opcache/jit/ir/ir_gcm.c)
3+
--EXTENSIONS--
4+
opcache
5+
--INI--
6+
opcache.enable=1
7+
opcache.enable_cli=1
8+
opcache.file_update_protection=0
9+
opcache.jit_buffer_size=32M
10+
opcache.jit=function
11+
--FILE--
12+
<?php
13+
$a = [2147483647,2147483647,2147483647,3,0,0,32,2147483584,127];
14+
echo @crc32(json_encode(bitwise_small_split($a))) . "\n";
15+
16+
function bitwise_small_split($val) {
17+
$split = 8;
18+
$len = count($val);
19+
while ($i != $len) {
20+
if (!$overflow) {
21+
$remaining -= $split;
22+
$overflow = $split <= $remaining ? 0 : $split - $remaining;
23+
} elseif (++$i != $len) {
24+
$fusion[$i] >>= $overflow;
25+
$remaining = 31 - $overflow;
26+
$overflow = $split <= $remaining ? 0 : $split - $remaining;
27+
}
28+
}
29+
}
30+
?>
31+
--EXPECT--
32+
634125391

0 commit comments

Comments
 (0)