diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c index e2bb21cbbf40..ac0a838ee548 100644 --- a/ext/opcache/jit/zend_jit_trace.c +++ b/ext/opcache/jit/zend_jit_trace.c @@ -5131,19 +5131,6 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par && ssa->vars[ssa_op->op1_def].alias == NO_ALIAS) { ssa->var_info[ssa_op->op1_def].guarded_reference = 1; } - if (opline->result_type == IS_UNUSED) { - res_addr = 0; - } else { - res_addr = RES_REG_ADDR(); - if (Z_MODE(res_addr) != IS_REG - && zend_jit_trace_next_is_send_result(opline, p, frame)) { - send_result = 1; - res_addr = ZEND_ADDR_MEM_ZVAL(ZREG_RX, (opline+1)->result.var); - if (!zend_jit_reuse_ip(&ctx)) { - goto jit_failure; - } - } - } op1_def_addr = op1_addr; op1_def_info &= ~MAY_BE_REF; } else if (op1_info & MAY_BE_REF) { @@ -5161,6 +5148,9 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par res_addr = RES_REG_ADDR(); res_info = RES_INFO(); if (Z_MODE(res_addr) != IS_REG + /* assignment to typed reference may cause conversion, + * so SEND_VAL has to check the type of the result */ + && !ref_addr && zend_jit_trace_next_is_send_result(opline, p, frame)) { send_result = 1; res_addr = ZEND_ADDR_MEM_ZVAL(ZREG_RX, (opline+1)->result.var); diff --git a/ext/opcache/tests/jit/gh24436.phpt b/ext/opcache/tests/jit/gh24436.phpt new file mode 100644 index 000000000000..cc60764759c4 --- /dev/null +++ b/ext/opcache/tests/jit/gh24436.phpt @@ -0,0 +1,38 @@ +--TEST-- +GH-24436 (Tracing JIT: wrong value of assignment to typed reference passed as argument) +--EXTENSIONS-- +opcache +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.jit=tracing +--FILE-- +$p, 3)); +} +var_dump($o->f, $o->s); +?> +--EXPECT-- +int(5) +int(5) +int(5) +float(5) +string(1) "5" +float(5) +string(1) "5"