Assertion failure in JIT trace exit with ZEND_FETCH_DIM_FUNC_ARG

[YuanchengJiang]

Description

The following code:

<?php
namespace Foo;
function test() {
$a['x'][1] = true;
for ($fusion = 0; $i < 3; $i++) {
var_dump($a['x'][0]);
}
}
test();

Resulted in this output:

php: ext/opcache/jit/zend_jit_trace.c:8657: int zend_jit_trace_exit(uint32_t, zend_jit_registers_buf *): Assertion `op->opcode == ZEND_FETCH_DIM_R || op->opcode == ZEND_FETCH_LIST_R || op->opcode == ZEND_FETCH_OBJ_R' failed.
Aborted (core dumped)

To reproduce:

-d "opcache.jit_hot_func=1" -d "opcache.jit_hot_side_exit=1" -d "zend_extension=/home/phpfuzz/WorkSpace/flowfusion/php-src/modules/opcache.so" -d "opcache.enable_cli=1" -d "opcache.jit=1254"

PHP Version

nightly

Operating System

ubuntu 22.04

[cmb69]

Only happens with opcache.jit_hot_func=1 and opcache.jit_hot_side_exit=1, so clearly is a JIT issue.

[nielsdos]

ZEND_FETCH_DIM_FUNC_ARG is not handled, but I think in that case we also have to simply repeat that opline, we can't assume the value to be NULL...