From 35985a92e5f26ce6c48f8f885faa925b433eba49 Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@zend.com>
Date: Mon, 29 Jul 2024 16:26:24 +0300
Subject: [PATCH] Fix GH-15101: _ir_RSTORE: Assertion `ctx->control'

---
 ext/opcache/jit/zend_jit_ir.c      |  2 +
 ext/opcache/tests/jit/gh15101.phpt | 77 ++++++++++++++++++++++++++++++
 2 files changed, 79 insertions(+)
 create mode 100644 ext/opcache/tests/jit/gh15101.phpt

diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c
index 966b22a08115..b1ab4f423ae6 100644
--- a/ext/opcache/jit/zend_jit_ir.c
+++ b/ext/opcache/jit/zend_jit_ir.c
@@ -8180,6 +8180,8 @@ static int zend_jit_type_check(zend_jit_ctx *jit, const zend_op *opline, uint32_
 	if (!smart_branch_opcode || exit_addr) {
 		if (end_inputs) {
 			ir_MERGE_list(end_inputs);
+		} else if (exit_addr && !jit->ctx.control) {
+			ir_BEGIN(IR_UNUSED); /* unreachable block */
 		}
 	} else {
 		_zend_jit_merge_smart_branch_inputs(jit, true_label, false_label, true_inputs, false_inputs);
diff --git a/ext/opcache/tests/jit/gh15101.phpt b/ext/opcache/tests/jit/gh15101.phpt
new file mode 100644
index 000000000000..8f7c963a68be
--- /dev/null
+++ b/ext/opcache/tests/jit/gh15101.phpt
@@ -0,0 +1,77 @@
+--TEST--
+GH-15101: _ir_RSTORE: Assertion `ctx->control' failed
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.revalidate_freq=0
+opcache.protect_memory=1
+--FILE--
+<?php
+class A {
+   function test($context, $token) { 
+       if ($token instanceof DoctypeToken) {
+            $this->processDoctypeToken($context, $token);
+        }
+    }
+    private function processDoctypeToken(TreeBuilderContext $context, DoctypeToken $token): void
+    {
+        $publicId = $token->publicIdentifier;
+        $systemId = $token->systemIdentifier;
+        $name = $token->name;
+
+        if ($name !== 'html'
+            || $publicId !== null
+            || ($systemId !== null && $systemId !== 'about:legacy-compat')) {
+        }
+
+        $doctype = new DocumentType($context->document, $name ?? '', $publicId ?? '', $systemId ?? '');
+    }
+}
+class Document {
+}
+final class TreeBuilderContext {
+    public $document;
+    public function __construct() {
+        $this->document = new Document;
+    }
+}
+abstract class Node {
+    public const DOCUMENT_TYPE_NODE = 10;
+
+    protected function __construct(Document $document, int $nodeType)
+    {
+    }
+}
+class DocumentType extends Node {
+    public readonly string $name;
+    public readonly string $publicId;
+    public readonly string $systemId;
+
+    public function __construct(
+        Document $document,
+        string $name,
+        string $publicId = '',
+        string $systemId = '') {
+        parent::__construct($document, self::DOCUMENT_TYPE_NODE);
+    }
+}
+class DoctypeToken {
+    public $publicIdentifier;
+    public $name;
+    public $systemIdentifier;
+}
+
+$a = new A;
+$doc = new TreeBuilderContext();
+$t = new DoctypeToken();
+$t->name = "html";
+foreach ([$doc, $t] as $token) {
+	$a->test($doc, $token);
+}
+?>
+DONE
+--EXPECT--
+DONE