Skip to content

Commit 08e7591

Browse files
dstogovdstogov
committed
Fix (at lease part of the) #GH-10635: ARM64 function JIT causes impossible assertion
1 parent ed0c0df commit 08e7591

File tree

3 files changed

+38
-10
lines changed

3 files changed

+38
-10
lines changed

‎ext/opcache/jit/zend_jit_arm64.dasc

+5-5
Original file line numberDiff line numberDiff line change
@@ -12349,7 +12349,7 @@ static int zend_jit_fetch_obj(dasm_State **Dst,
1234912349
type_loaded = 1;
1235012350
prop_addr = ZEND_ADDR_MEM_ZVAL(ZREG_FCARG1, 0);
1235112351
if (opline->opcode == ZEND_FETCH_OBJ_W
12352-
&& (!ce || ce_is_instanceof || (ce->ce_flags & ZEND_ACC_HAS_TYPE_HINTS))) {
12352+
&& (!ce || ce_is_instanceof || (ce->ce_flags & (ZEND_ACC_HAS_TYPE_HINTS|ZEND_ACC_TRAIT)))) {
1235312353
uint32_t flags = opline->extended_value & ZEND_FETCH_OBJ_FLAGS;
1235412354

1235512355
| ldr REG0, EX->run_time_cache
@@ -12833,7 +12833,7 @@ static int zend_jit_incdec_obj(dasm_State **Dst,
1283312833
| ldr TMP1, [FCARG1x, #offsetof(zend_object, ce)]
1283412834
| cmp REG2, TMP1
1283512835
| bne >7
12836-
if (!ce || ce_is_instanceof || (ce->ce_flags & ZEND_ACC_HAS_TYPE_HINTS)) {
12836+
if (!ce || ce_is_instanceof || (ce->ce_flags & (ZEND_ACC_HAS_TYPE_HINTS|ZEND_ACC_TRAIT))) {
1283712837
| MEM_ACCESS_64_WITH_UOFFSET ldr, TMP1, REG0, (opline->extended_value + sizeof(void*) * 2), TMP1
1283812838
| cbnz TMP1, >7
1283912839
}
@@ -13267,7 +13267,7 @@ static int zend_jit_assign_obj_op(dasm_State **Dst,
1326713267
| ldr TMP2, [FCARG1x, #offsetof(zend_object, ce)]
1326813268
| cmp REG2, TMP2
1326913269
| bne >7
13270-
if (!ce || ce_is_instanceof || (ce->ce_flags & ZEND_ACC_HAS_TYPE_HINTS)) {
13270+
if (!ce || ce_is_instanceof || (ce->ce_flags & (ZEND_ACC_HAS_TYPE_HINTS|ZEND_ACC_TRAIT))) {
1327113271
| MEM_ACCESS_64_WITH_UOFFSET ldr, TMP1, REG0, ((opline+1)->extended_value + sizeof(void*) * 2), TMP1
1327213272
| cbnz TMP1, >7
1327313273
}
@@ -13645,7 +13645,7 @@ static int zend_jit_assign_obj(dasm_State **Dst,
1364513645
| ldr TMP1, [FCARG1x, #offsetof(zend_object, ce)]
1364613646
| cmp REG2, TMP1
1364713647
| bne >5
13648-
if (!ce || ce_is_instanceof || (ce->ce_flags & ZEND_ACC_HAS_TYPE_HINTS)) {
13648+
if (!ce || ce_is_instanceof || (ce->ce_flags & (ZEND_ACC_HAS_TYPE_HINTS|ZEND_ACC_TRAIT))) {
1364913649
| MEM_ACCESS_64_WITH_UOFFSET ldr, FCARG2x, REG0, (opline->extended_value + sizeof(void*) * 2), TMP1
1365013650
}
1365113651
| MEM_ACCESS_64_WITH_UOFFSET ldr, REG0, REG0, (opline->extended_value + sizeof(void*)), TMP1
@@ -13656,7 +13656,7 @@ static int zend_jit_assign_obj(dasm_State **Dst,
1365613656
| IF_TYPE TMP1w, IS_UNDEF, >5
1365713657
| mov FCARG1x, TMP2
1365813658
prop_addr = ZEND_ADDR_MEM_ZVAL(ZREG_FCARG1, 0);
13659-
if (!ce || ce_is_instanceof || (ce->ce_flags & ZEND_ACC_HAS_TYPE_HINTS)) {
13659+
if (!ce || ce_is_instanceof || (ce->ce_flags & (ZEND_ACC_HAS_TYPE_HINTS|ZEND_ACC_TRAIT))) {
1366013660
| cbnz FCARG2x, >1
1366113661
|.cold_code
1366213662
|1:

‎ext/opcache/jit/zend_jit_x86.dasc

+5-5
Original file line numberDiff line numberDiff line change
@@ -13075,7 +13075,7 @@ static int zend_jit_fetch_obj(dasm_State **Dst,
1307513075
type_loaded = 1;
1307613076
prop_addr = ZEND_ADDR_MEM_ZVAL(ZREG_FCARG1, 0);
1307713077
if (opline->opcode == ZEND_FETCH_OBJ_W
13078-
&& (!ce || ce_is_instanceof || (ce->ce_flags & ZEND_ACC_HAS_TYPE_HINTS))) {
13078+
&& (!ce || ce_is_instanceof || (ce->ce_flags & (ZEND_ACC_HAS_TYPE_HINTS|ZEND_ACC_TRAIT)))) {
1307913079
uint32_t flags = opline->extended_value & ZEND_FETCH_OBJ_FLAGS;
1308013080

1308113081
| mov r0, EX->run_time_cache
@@ -13571,7 +13571,7 @@ static int zend_jit_incdec_obj(dasm_State **Dst,
1357113571
| mov r2, aword [r0 + opline->extended_value]
1357213572
| cmp r2, aword [FCARG1a + offsetof(zend_object, ce)]
1357313573
| jne >7
13574-
if (!ce || ce_is_instanceof || (ce->ce_flags & ZEND_ACC_HAS_TYPE_HINTS)) {
13574+
if (!ce || ce_is_instanceof || (ce->ce_flags & (ZEND_ACC_HAS_TYPE_HINTS|ZEND_ACC_TRAIT))) {
1357513575
| cmp aword [r0 + opline->extended_value + sizeof(void*) * 2], 0
1357613576
| jnz >7
1357713577
}
@@ -14044,7 +14044,7 @@ static int zend_jit_assign_obj_op(dasm_State **Dst,
1404414044
| mov r2, aword [r0 + (opline+1)->extended_value]
1404514045
| cmp r2, aword [FCARG1a + offsetof(zend_object, ce)]
1404614046
| jne >7
14047-
if (!ce || ce_is_instanceof || (ce->ce_flags & ZEND_ACC_HAS_TYPE_HINTS)) {
14047+
if (!ce || ce_is_instanceof || (ce->ce_flags & (ZEND_ACC_HAS_TYPE_HINTS|ZEND_ACC_TRAIT))) {
1404814048
| cmp aword [r0 + (opline+1)->extended_value + sizeof(void*) * 2], 0
1404914049
| jnz >7
1405014050
}
@@ -14463,7 +14463,7 @@ static int zend_jit_assign_obj(dasm_State **Dst,
1446314463
| mov r2, aword [r0 + opline->extended_value]
1446414464
| cmp r2, aword [FCARG1a + offsetof(zend_object, ce)]
1446514465
| jne >5
14466-
if (!ce || ce_is_instanceof || (ce->ce_flags & ZEND_ACC_HAS_TYPE_HINTS)) {
14466+
if (!ce || ce_is_instanceof || (ce->ce_flags & (ZEND_ACC_HAS_TYPE_HINTS|ZEND_ACC_TRAIT))) {
1446714467
| mov FCARG2a, aword [r0 + opline->extended_value + sizeof(void*) * 2]
1446814468
}
1446914469
| mov r0, aword [r0 + opline->extended_value + sizeof(void*)]
@@ -14472,7 +14472,7 @@ static int zend_jit_assign_obj(dasm_State **Dst,
1447214472
| IF_TYPE byte [FCARG1a + r0 + 8], IS_UNDEF, >5
1447314473
| add FCARG1a, r0
1447414474
prop_addr = ZEND_ADDR_MEM_ZVAL(ZREG_FCARG1, 0);
14475-
if (!ce || ce_is_instanceof || (ce->ce_flags & ZEND_ACC_HAS_TYPE_HINTS)) {
14475+
if (!ce || ce_is_instanceof || (ce->ce_flags & (ZEND_ACC_HAS_TYPE_HINTS|ZEND_ACC_TRAIT))) {
1447614476
| test FCARG2a, FCARG2a
1447714477
| jnz >1
1447814478
|.cold_code

‎ext/opcache/tests/jit/gh10635.phpt

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
--TEST--
2+
GH-10635: Function JIT causes impossible assertion
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.file_update_protection=0
7+
opcache.jit_buffer_size=1M
8+
--FILE--
9+
<?php
10+
trait T {
11+
function foo() {
12+
return reset($this->a);
13+
}
14+
}
15+
class C {
16+
use T;
17+
private array $a = [1];
18+
}
19+
$o = new C;
20+
$o->foo();
21+
unset($o);
22+
$o = new C;
23+
$o->foo();
24+
unset($o);
25+
?>
26+
DONE
27+
--EXPECT--
28+
DONE

0 commit comments

Comments
 (0)