Skip to content

Commit 1cd8074

Browse files
committed
JIT: Fix missing register store
This fixes oss-fuzz #48023
1 parent 0b8e471 commit 1cd8074

File tree

2 files changed

+32
-0
lines changed

2 files changed

+32
-0
lines changed

ext/opcache/jit/zend_jit_x86.dasc

+10
Original file line numberDiff line numberDiff line change
@@ -3967,6 +3967,16 @@ static int zend_jit_update_regs(dasm_State **Dst, uint32_t var, zend_jit_addr sr
39673967
} else {
39683968
ZEND_UNREACHABLE();
39693969
}
3970+
} else if (Z_MODE(dst) == IS_REG && Z_STORE(dst)) {
3971+
dst = ZEND_ADDR_MEM_ZVAL(ZREG_FP, var);
3972+
if (!zend_jit_spill_store(Dst, src, dst, info,
3973+
JIT_G(trigger) != ZEND_JIT_ON_HOT_TRACE ||
3974+
JIT_G(current_frame) == NULL ||
3975+
STACK_MEM_TYPE(JIT_G(current_frame)->stack, EX_VAR_TO_NUM(var)) == IS_UNKNOWN ||
3976+
(1 << STACK_MEM_TYPE(JIT_G(current_frame)->stack, EX_VAR_TO_NUM(var))) != (info & MAY_BE_ANY)
3977+
)) {
3978+
return 0;
3979+
}
39703980
}
39713981
return 1;
39723982
}
+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
--TEST--
2+
Register Alloction 015: Missing store
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.file_update_protection=0
7+
opcache.jit_buffer_size=1M
8+
--FILE--
9+
<?php
10+
function foo() {
11+
for ($i=0, $y = $a + $y = $a = $y %= !$y; $i < 5; $a = $y < $y = $a, $i++) {
12+
4 >> -$y;
13+
}
14+
}
15+
foo()
16+
?>
17+
DONE
18+
--EXPECTF--
19+
Warning: Undefined variable $y in %sreg_alloc_015.php on line 3
20+
21+
Warning: Undefined variable $y in %sreg_alloc_015.php on line 3
22+
DONE

0 commit comments

Comments
 (0)