Assertion failure ext/opcache/jit/ir/ir_gcm.c

[YuanchengJiang]

Description

The following code:

<?php
$a = [2147483647,2147483647,2147483647,3,0,0,32,2147483584,127];
echo crc32(json_encode(bitwise_small_split($a))) . "\n";
function bitwise_small_split($val)
{
$split = 8;
$len = count($val);
while ($i != $len) {
if (!$overflow) {
$remaining -= $split;
$overflow = $split <= $remaining ? 0 : $split - $remaining;
} elseif (++$i != $len) {
$fusion[$i] >>= $overflow;
$remaining = 31 - $overflow;
$overflow = $split <= $remaining ? 0 : $split - $remaining;
}
}
}

Resulted in this output:

php: /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/opcache/jit/ir/ir_gcm.c:530: void ir_gcm_schedule_late(ir_ctx *, ir_ref, uint32_t): Assertion `ir_gcm_dominates(ctx, ctx->cfg_map[ref], lca) && "Early placement doesn't dominate the late"' failed.
Aborted (core dumped

To reproduce:

-d "opcache.jit_hot_func=1" -d "opcache.jit_hot_side_exit=1" -d "zend_extension=/home/phpfuzz/WorkSpace/flowfusion/php-src/modules/opcache.so" -d "opcache.enable_cli=1" -d "opcache.jit=1254"

PHP Version

nightly

Operating System

No response

[iluuu1994]

/cc @dstogov