Skip to content

Commit db26aee

Browse files
dstogovdstogov
committed
Merge branch 'PHP-8.1' into PHP-8.2
* PHP-8.1: Backport fix for GH-12512: JIT Assertion `info & (1 << type)' failed (#12660)
2 parents d224faa + c60c2a0 commit db26aee

File tree

3 files changed

+154
-3
lines changed

3 files changed

+154
-3
lines changed

‎ext/opcache/jit/zend_jit_trace.c

+69-3
Original file line numberDiff line numberDiff line change
@@ -5033,6 +5033,21 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
50335033
zend_may_throw_ex(opline, ssa_op, op_array, ssa, op1_info, op2_info))) {
50345034
goto jit_failure;
50355035
}
5036+
if (ssa_op->op2_def > 0
5037+
&& Z_MODE(op2_addr) == IS_REG
5038+
&& ssa->vars[ssa_op->op2_def].no_val) {
5039+
uint8_t type = (op2_info & MAY_BE_LONG) ? IS_LONG : IS_DOUBLE;
5040+
uint32_t var_num = EX_VAR_TO_NUM(opline->op2.var);
5041+
5042+
if (STACK_MEM_TYPE(stack, var_num) != type
5043+
&& ssa->vars[ssa_op->op2_def].use_chain < 0
5044+
&& !ssa->vars[ssa_op->op2_def].phi_use_chain) {
5045+
if (!zend_jit_store_var_type(&dasm_state, var_num, type)) {
5046+
return 0;
5047+
}
5048+
SET_STACK_TYPE(stack, var_num, type, 1);
5049+
}
5050+
}
50365051
if (opline->op2_type == IS_CV
50375052
&& ssa_op->op2_def >= 0
50385053
&& ssa->vars[ssa_op->op2_def].alias == NO_ALIAS) {
@@ -5069,6 +5084,21 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
50695084
res_use_info, res_info, res_addr)) {
50705085
goto jit_failure;
50715086
}
5087+
if (ssa_op->op1_def > 0
5088+
&& Z_MODE(op1_addr) == IS_REG
5089+
&& ssa->vars[ssa_op->op1_def].no_val) {
5090+
uint8_t type = (op1_info & MAY_BE_LONG) ? IS_LONG : IS_DOUBLE;
5091+
uint32_t var_num = EX_VAR_TO_NUM(opline->op1.var);
5092+
5093+
if (STACK_MEM_TYPE(stack, var_num) != type
5094+
&& ssa->vars[ssa_op->op1_def].use_chain < 0
5095+
&& !ssa->vars[ssa_op->op1_def].phi_use_chain) {
5096+
if (!zend_jit_store_var_type(&dasm_state, var_num, type)) {
5097+
return 0;
5098+
}
5099+
SET_STACK_TYPE(stack, var_num, type, 1);
5100+
}
5101+
}
50725102
if (opline->op1_type == IS_CV
50735103
&& ssa_op->op1_def >= 0
50745104
&& ssa->vars[ssa_op->op1_def].alias == NO_ALIAS) {
@@ -5151,6 +5181,21 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
51515181
op1_info, op1_addr, op1_def_addr)) {
51525182
goto jit_failure;
51535183
}
5184+
if (ssa_op->op1_def > 0
5185+
&& Z_MODE(op1_addr) == IS_REG
5186+
&& ssa->vars[ssa_op->op1_def].no_val) {
5187+
uint8_t type = (op1_info & MAY_BE_LONG) ? IS_LONG : IS_DOUBLE;
5188+
uint32_t var_num = EX_VAR_TO_NUM(opline->op1.var);
5189+
5190+
if (STACK_MEM_TYPE(stack, var_num) != type
5191+
&& ssa->vars[ssa_op->op1_def].use_chain < 0
5192+
&& !ssa->vars[ssa_op->op1_def].phi_use_chain) {
5193+
if (!zend_jit_store_var_type(&dasm_state, var_num, type)) {
5194+
return 0;
5195+
}
5196+
SET_STACK_TYPE(stack, var_num, type, 1);
5197+
}
5198+
}
51545199
if (opline->op1_type == IS_CV
51555200
&& ssa_op->op1_def >= 0
51565201
&& ssa->vars[ssa_op->op1_def].alias == NO_ALIAS) {
@@ -6861,9 +6906,30 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
68616906
}
68626907
} else if (p->stop == ZEND_JIT_TRACE_STOP_LINK
68636908
|| p->stop == ZEND_JIT_TRACE_STOP_INTERPRETER) {
6864-
if (!zend_jit_trace_deoptimization(&dasm_state, 0, NULL,
6865-
stack, op_array->last_var + op_array->T, NULL, NULL, NULL, 0)) {
6866-
goto jit_failure;
6909+
if (ra
6910+
&& (p-1)->op != ZEND_JIT_TRACE_ENTER
6911+
&& (p-1)->op != ZEND_JIT_TRACE_BACK
6912+
&& opline->opcode != ZEND_DO_UCALL
6913+
&& opline->opcode != ZEND_DO_FCALL
6914+
&& opline->opcode != ZEND_DO_FCALL_BY_NAME
6915+
&& opline->opcode != ZEND_INCLUDE_OR_EVAL) {
6916+
if (!zend_jit_trace_deoptimization(&dasm_state, 0, NULL,
6917+
stack, op_array->last_var + op_array->T, NULL, NULL, NULL, 0)) {
6918+
goto jit_failure;
6919+
}
6920+
for (i = 0; i < op_array->last_var; i++) {
6921+
int8_t reg = STACK_REG(stack, i);
6922+
uint8_t type = STACK_TYPE(stack, i);
6923+
6924+
if (reg == ZREG_NONE
6925+
&& type != IS_UNKNOWN
6926+
&& type != STACK_MEM_TYPE(stack, i)) {
6927+
if (!zend_jit_store_var_type(&dasm_state, i, type)) {
6928+
return 0;
6929+
}
6930+
SET_STACK_TYPE(stack, i, type, 1);
6931+
}
6932+
}
68676933
}
68686934
if (p->stop == ZEND_JIT_TRACE_STOP_LINK) {
68696935
const void *timeout_exit_addr = NULL;

‎ext/opcache/tests/jit/gh12512.phpt

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
--TEST--
2+
GH-12512: missing type store
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
--FILE--
7+
<?php
8+
function bar(array &$a): ?bool {
9+
$ret = null;
10+
foreach ($a as $key => $val) {
11+
if ($val === 2) {
12+
unset($a[$key]);
13+
}
14+
}
15+
return $ret;
16+
}
17+
18+
function foo($a, bool $b): bool {
19+
if ($b) return true;
20+
$n2 = count($a);
21+
do {
22+
$n = $n2;
23+
$res = bar($a);
24+
$n2 = count($a);
25+
} while ($res === null && $n !== $n2);
26+
27+
if ($res === null && $n === 0) {
28+
return false;
29+
}
30+
return true;
31+
}
32+
33+
$a = [1,'a'=>5];
34+
bar($a);
35+
foo([1,'a'=>5], true);
36+
foo([1,'a'=>5], false);
37+
foo([2,'a'=>5], false);
38+
?>
39+
DONE
40+
--EXPECT--
41+
DONE

‎ext/opcache/tests/jit/gh12512_2.phpt

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
--TEST--
2+
GH-12512: missing type store
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
--FILE--
7+
<?php
8+
function foo(array $a, $exit) {
9+
$n = 0;
10+
11+
$count = count($a);
12+
if ($count == 0) {
13+
return 0;
14+
}
15+
$a2 = [];
16+
foreach ($a as $v) {
17+
$a2[] = $v;
18+
}
19+
20+
$count = $a2[5];
21+
22+
for ($i = 0; $i < $count; $i++) {
23+
$x = $a[$i];
24+
for ($k = $i + 1; $k < $count; $k++) {
25+
$y = $a[$k];
26+
$n += $x > $y;
27+
}
28+
if ($exit) {
29+
return $n;
30+
}
31+
}
32+
33+
return $n;
34+
}
35+
var_dump(foo([1,2,3,4,5,6,7,8], 1));
36+
var_dump(foo([1,2,3,4,5,6,7,8], 1));
37+
var_dump(foo([1,2,3,4,5,6,7,8], 0));
38+
?>
39+
DONE
40+
--EXPECT--
41+
int(0)
42+
int(0)
43+
int(0)
44+
DONE

0 commit comments

Comments
 (0)