Tracing JIT type mismatch when returning UNDEF

[YuanchengJiang]

Description

The following code:

<?php
function utf32_utf8($k) {
return $fusion;
}
for ($i = 0; $i < 0x2710; $i++) {
$str = utf32_utf8($i);
}

Resulted in this output:

ext/opcache/jit/zend_jit_trace.c:348: uint32_t zend_jit_trace_type_to_info_ex(uint8_t, uint32_t): Assertion `info & (1 << type)' failed.
Aborted (core dumped)

To reproduce:

-d "opcache.jit_hot_loop=1" -d "zend_extension=/php-src/modules/opcache.so" -d "opcache.enable_cli=1" -d "opcache.jit=1254"

PHP Version

nightly

Operating System

ubuntu 22.04

[nielsdos]

Well it's related to what the tracer infers as types. We get an exit point which is inferred as undef, but the tracer transforms the return value info as follows:

php-src/ext/opcache/jit/zend_jit_trace.c

Lines 2196 to 2199 in 28344e0

	if (return_value_info.type & MAY_BE_UNDEF) {
	return_value_info.type &= ~MAY_BE_UNDEF;
	return_value_info.type |= MAY_BE_NULL;
	}

Here we removed the MAY_BE_UNDEF flag, but if we don't do that the code works. Probably a transformation of UNDEF to NULL is missing somewhere...

[nielsdos]

Well either the idea above fixes this, or this:

diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c
index abe15a9ffa1..d316e1fcf26 100644
--- a/ext/opcache/jit/zend_jit_trace.c
+++ b/ext/opcache/jit/zend_jit_trace.c
@@ -6993,6 +6993,9 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
 			 && (p+1)->op == ZEND_JIT_TRACE_VM) {
 				const zend_op *opline = (p+1)->opline - 1;
 				if (opline->result_type != IS_UNUSED) {
+					if (res_type == IS_UNDEF) {
+						res_type = IS_NULL;
+					}
 				    SET_STACK_TYPE(stack, EX_VAR_TO_NUM(opline->result.var), res_type, 1);
 				}
 			}

Have to think a bit...