Skip to content

Commit c51f4e1

Browse files
ndosschendossche
committed
Merge branch 'PHP-8.5' into PHP-8.6
* PHP-8.5: Fix GH-24337: JIT segfault when decrementing a non-numeric string property
2 parents 1fa14b0 + 6ee6f67 commit c51f4e1

3 files changed

Lines changed: 111 additions & 3 deletions

File tree

‎NEWS‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,8 @@ PHP NEWS
4949
. Fix exception checks due to NAN warnings and object empty()'s. (ndossche)
5050
. Fixed bug GH-24270 (JIT loses the called scope of self:: and parent:: calls
5151
in closures). (RV7PR)
52+
. Fixed bug GH-24337 (JIT: segfault when decrementing a non-numeric string
53+
property). (Lazizbek Ergashev)
5254

5355
- PDO:
5456
. Fixed a duplicate warning when ATTR_STATEMENT_CLASS is rejected on a

‎ext/opcache/jit/zend_jit_ir.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15971,12 +15971,13 @@ static int zend_jit_incdec_obj(zend_jit_ctx *jit,
1597115971
}
1597215972

1597315973
if (var_info & (MAY_BE_ANY - MAY_BE_LONG)) {
15974-
if (var_info & (MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
15975-
may_throw = true;
15976-
}
1597715974
if (if_long) {
1597815975
ir_IF_FALSE_cold(if_long);
1597915976
}
15977+
if (var_info & (MAY_BE_ANY - (MAY_BE_LONG|MAY_BE_DOUBLE))) {
15978+
may_throw = true;
15979+
jit_SET_EX_OPLINE(jit, opline);
15980+
}
1598015981
if (opline->opcode == ZEND_POST_INC_OBJ || opline->opcode == ZEND_POST_DEC_OBJ) {
1598115982
jit_ZVAL_COPY(jit, res_addr, -1, var_addr, var_info, true);
1598215983
}

‎ext/opcache/tests/jit/gh24337.phpt‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
--TEST--
2+
GH-24337 (JIT: segfault in zend_get_executed_lineno when decrementing a non-numeric string property)
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.file_update_protection=0
7+
opcache.jit_buffer_size=64M
8+
opcache.jit=tracing
9+
opcache.jit_hot_loop=2
10+
opcache.jit_hot_func=2
11+
opcache.jit_hot_return=2
12+
opcache.jit_hot_side_exit=1
13+
--EXTENSIONS--
14+
opcache
15+
--FILE--
16+
<?php
17+
set_error_handler(function ($errno, $errstr, $errfile, $errline) {
18+
echo "$errstr on line $errline\n";
19+
});
20+
class Q {
21+
public $pu = 0;
22+
function run() {
23+
for ($i = 0; $i < 2; $i++) {
24+
$this->pu--;
25+
}
26+
}
27+
function inc() {
28+
for ($i = 0; $i < 2; $i++) {
29+
$this->pu++;
30+
}
31+
}
32+
}
33+
class S extends Q {
34+
public $pu = 'u';
35+
function run() {
36+
parent::run();
37+
}
38+
}
39+
class B extends Q {
40+
public $pu = true;
41+
function run() {
42+
parent::run();
43+
}
44+
}
45+
class A extends Q {
46+
public $pu = [];
47+
function run() {
48+
parent::run();
49+
}
50+
}
51+
$objs = [new Q, new S, new B, new A];
52+
for ($k = 0; $k < 4; $k++) {
53+
foreach ($objs as $o) {
54+
try {
55+
$o->run();
56+
} catch (TypeError $e) {
57+
echo $e->getMessage(), " on line ", $e->getLine(), "\n";
58+
}
59+
try {
60+
$o->inc();
61+
} catch (TypeError $e) {
62+
echo $e->getMessage(), " on line ", $e->getLine(), "\n";
63+
}
64+
}
65+
}
66+
var_dump($objs[0]->pu, $objs[1]->pu, $objs[2]->pu, $objs[3]->pu);
67+
?>
68+
--EXPECT--
69+
Decrement on non-numeric string has no effect and is deprecated on line 9
70+
Decrement on non-numeric string has no effect and is deprecated on line 9
71+
Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
72+
Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
73+
Increment on type bool has no effect, this will change in the next major version of PHP on line 14
74+
Increment on type bool has no effect, this will change in the next major version of PHP on line 14
75+
Cannot decrement array on line 9
76+
Cannot increment array on line 14
77+
Decrement on non-numeric string has no effect and is deprecated on line 9
78+
Decrement on non-numeric string has no effect and is deprecated on line 9
79+
Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
80+
Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
81+
Increment on type bool has no effect, this will change in the next major version of PHP on line 14
82+
Increment on type bool has no effect, this will change in the next major version of PHP on line 14
83+
Cannot decrement array on line 9
84+
Cannot increment array on line 14
85+
Decrement on non-numeric string has no effect and is deprecated on line 9
86+
Decrement on non-numeric string has no effect and is deprecated on line 9
87+
Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
88+
Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
89+
Increment on type bool has no effect, this will change in the next major version of PHP on line 14
90+
Increment on type bool has no effect, this will change in the next major version of PHP on line 14
91+
Cannot decrement array on line 9
92+
Cannot increment array on line 14
93+
Decrement on non-numeric string has no effect and is deprecated on line 9
94+
Decrement on non-numeric string has no effect and is deprecated on line 9
95+
Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
96+
Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
97+
Increment on type bool has no effect, this will change in the next major version of PHP on line 14
98+
Increment on type bool has no effect, this will change in the next major version of PHP on line 14
99+
Cannot decrement array on line 9
100+
Cannot increment array on line 14
101+
int(0)
102+
string(2) "ac"
103+
bool(true)
104+
array(0) {
105+
}

0 commit comments

Comments
 (0)