Repository navigation
Assertion failure in JIT trace exit with ZEND_FETCH_DIM_FUNC_ARG #17140
Description
Description
The following code:
<?php
namespace Foo;
function test() {
$a['x'][1] = true;
for ($fusion = 0; $i < 3; $i++) {
var_dump($a['x'][0]);
}
}
test();Resulted in this output:
php: ext/opcache/jit/zend_jit_trace.c:8657: int zend_jit_trace_exit(uint32_t, zend_jit_registers_buf *): Assertion `op->opcode == ZEND_FETCH_DIM_R || op->opcode == ZEND_FETCH_LIST_R || op->opcode == ZEND_FETCH_OBJ_R' failed.
Aborted (core dumped)
To reproduce:
-d "opcache.jit_hot_func=1" -d "opcache.jit_hot_side_exit=1" -d "zend_extension=/home/phpfuzz/WorkSpace/flowfusion/php-src/modules/opcache.so" -d "opcache.enable_cli=1" -d "opcache.jit=1254"
PHP Version
nightly
Operating System
ubuntu 22.04
Reacted by Christoph M. Becker
Activity
cmb69 commentedon Dec 13, 2024
Only happens with
opcache.jit_hot_func=1andopcache.jit_hot_side_exit=1, so clearly is a JIT issue.ndossche commentedon Dec 13, 2024
ZEND_FETCH_DIM_FUNC_ARG is not handled, but I think in that case we also have to simply repeat that opline, we can't assume the value to be NULL...
[-]Assertion failure ext/opcache/jit/zend_jit_trace.c:8657[/-][+]Assertion failure in JIT trace exit with ZEND_FETCH_DIM_FUNC_ARG[/+]Merge branch 'PHP-8.4'
Fix GH-17140 (Assertion failure in JIT trace exit with ZEND_FETCH_DIM…