Repository navigation
Conversation
Don't bind a CV to its VM slot when its IR ref was emitted by an earlier opline (e.g. MUL by 1.0 folded to op1, or a CSE'd expression). The ref may be shared with another live var, whose snapshot entry would then be wrongly marked type_only. Fixes phpGH-24471
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A CV was bound to its VM slot even when its IR ref came from an earlier opline, e.g.
MUL x, 1.0folded tox, or a CSE'd expression. That ref can also belong to another live var. The snapshot then sees the value spilled to a VM slot and marks that vartype_only, but the slot belongs to the CV, so on exit the VM reads a stale value from the var's own slot.The fix skips the binding when the ref was emitted before the current opline. Only the tracing JIT is affected.
No measurable cost on Symfony Demo or Zend/bench.php: callgrind instructions are within noise and JIT code size is identical.
Fixes GH-24471