Fixed bug #80839 (PHP problem with JIT)

Author: dstogov

NEWS

@@ -9,6 +9,9 @@ PHP                                                                        NEWS
   . Fixed bug #80847 (CData structs with fields of type struct can't be passed
     as C function argument). (Nickolas Daniel da Silva, Dmitry)
 
+- Opcache:
+  . Fixed bug #80839 (PHP problem with JIT). (Dmitry)
+
 01 Apr 2021, PHP 8.0.4
 
 - Core:

ext/opcache/jit/zend_jit_x86.dasc

@@ -5221,6 +5221,9 @@ static int zend_jit_concat_helper(dasm_State    **Dst,
 			|	add r4, 12
 			|.endif
 		}
+		/* concatination with empty string may increase refcount */
+		op1_info |= MAY_BE_RCN;
+		op2_info |= MAY_BE_RCN;
 		|	FREE_OP op1_type, op1, op1_info, 0, opline
 		|	FREE_OP op2_type, op2, op2_info, 0, opline
 		|5:
@@ -5247,6 +5250,9 @@ static int zend_jit_concat_helper(dasm_State    **Dst,
 		|.if not(X64)
 		|	add r4, 12
 		|.endif
+		/* concatination with empty string may increase refcount */
+		op1_info |= MAY_BE_RCN;
+		op2_info |= MAY_BE_RCN;
 		|	FREE_OP op1_type, op1, op1_info, 0, opline
 		|	FREE_OP op2_type, op2, op2_info, 0, opline
 		if (may_throw) {

ext/opcache/tests/jit/bug80839.phpt

@@ -0,0 +1,37 @@
+--TEST--
+Bug #80839: PHP problem with JIT
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit_buffer_size=1M
+opcache.jit=function
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+$a = null; // the problem only occurs when set to NULL
+test($a, 'y');
+
+function test($str, $pad) {
+	$x = $str . str_repeat($pad, 15); // $x now contains "yyyyyyyyyyyyyyy"
+	var_dump($x);
+
+	$gft = new gft();
+	$gft->info(33);
+
+	// $x has been changed ????
+	// $x contains what was echoed in the function 'info'
+	var_dump($x);
+}
+class gft {
+	private $strVal = 'abcd ';
+	public function info($info, $prefix = ' Info:') {
+		echo $this->strVal.$prefix.serialize($info).'aaaa';
+		echo "\n";
+	}
+}
+?>
+--EXPECT--
+string(15) "yyyyyyyyyyyyyyy"
+abcd  Info:i:33;aaaa
+string(15) "yyyyyyyyyyyyyyy"