Skip to content

Commit 9f33bff

Browse files
committed
Reset stackmap reg
Add a missing `t->stack_map[...].reg = ZREG_NONE` in `zend_jit_snapshot_handler`. This is needed when reg is `ZREG_NONE`, otherwise side traces will have wrong assumptions. Fixes GH-21158 Closes GH-21531
1 parent 5cd8777 commit 9f33bff

File tree

3 files changed

+54
-0
lines changed

3 files changed

+54
-0
lines changed

NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@ PHP NEWS
99
- Iconv:
1010
. Fixed bug GH-17399 (iconv memory leak on bailout). (iliaal)
1111

12+
- Opcache:
13+
. Fixed bug GH-21158 (JIT: Assertion jit->ra[var].flags & (1<<0) failed in
14+
zend_jit_use_reg). (Arnaud)
15+
1216
- SPL:
1317
. Fixed bug GH-21499 (RecursiveArrayIterator getChildren UAF after parent
1418
free). (Girgias)

ext/opcache/jit/zend_jit_ir.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -835,6 +835,7 @@ void *zend_jit_snapshot_handler(ir_ctx *ctx, ir_ref snapshot_ref, ir_insn *snaps
835835
addr = (void*)zend_jit_trace_get_exit_addr(exit_point);
836836
exit_flags &= ~ZEND_JIT_EXIT_FIXED;
837837
}
838+
t->stack_map[t->exit_info[exit_point].stack_offset + var].reg = ZREG_NONE;
838839
t->stack_map[t->exit_info[exit_point].stack_offset + var].flags = ZREG_TYPE_ONLY;
839840
}
840841
} else if (!(exit_flags & ZEND_JIT_EXIT_FIXED)) {

ext/opcache/tests/jit/gh21158.phpt

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
--TEST--
2+
GH-21158: Assertion jit->ra[var].flags & (1<<0) failed in zend_jit_use_reg
3+
--CREDITS--
4+
YuanchengJiang
5+
--EXTENSIONS--
6+
opcache
7+
--INI--
8+
opcache.jit=1254
9+
--FILE--
10+
<?php
11+
define('ROW', 10);
12+
define('COL', 10);
13+
function count_live_neighbors($board, $row, $col) {
14+
$live_neighbors = 0;
15+
if ($col + 1 < COL && $board[$row][$col + 1] == 1) $live_neighbors++;
16+
if ($row - 1 >= 0 && $col - 1 >= 0 && $board[$row - 1][$col - 1] == 1) $live_neighbors++;
17+
if ($row >= 1 && $col + 1 < COL && $board[$row - 1][$col + 1] == 1) $live_neighbors++;
18+
return $live_neighbors;
19+
}
20+
$board = [
21+
[1,1,0,0,1,1,1,1,1,0],
22+
[0,1,0,1,1,0,0,1,0,0],
23+
[0,1,0,0,1,0,0,0,1,0],
24+
[0,0,1,1,1,1,1,0,0,0],
25+
[1,1,1,1,1,1,0,1,1,0],
26+
[0,1,0,0,1,1,1,0,1,0],
27+
[0,1,1,0,1,1,1,1,0,0],
28+
[1,1,0,0,0,0,1,1,1,0],
29+
[1,0,0,1,1,0,1,1,0,1],
30+
[0,0,1,1,1,0,1,1,0,1],
31+
];
32+
for ($i = 0; $i < ROW; $i++) {
33+
for ($j = 0; $j < COL; $j++) {
34+
echo count_live_neighbors($board, $i, $j), ",";
35+
}
36+
echo "\n";
37+
}
38+
?>
39+
--EXPECT--
40+
1,0,0,1,1,1,1,1,0,0,
41+
2,1,2,2,1,2,3,2,1,1,
42+
2,0,2,2,1,1,1,1,1,0,
43+
1,1,2,2,1,2,0,1,0,1,
44+
1,2,2,3,3,2,2,2,0,0,
45+
2,2,2,3,3,2,2,2,1,1,
46+
2,1,1,2,2,3,2,2,0,1,
47+
2,1,1,2,1,3,3,2,1,0,
48+
1,1,2,1,0,2,2,2,2,1,
49+
0,2,2,2,1,3,2,1,3,0,

0 commit comments

Comments
 (0)