JIT appears not to correctly account for property references in some cases #19831

Activity

1. dktapps

   added

   Bug

   Status: Needs Triage

   on Sep 13, 2025
2. dktapps commented on Sep 13, 2025

   

   dktapps

   on Sep 13, 2025

   Last edited by dktapps

   ContributorAuthor

   More actions

   Partial reproducing test case follows. Note that the Test class must be declared in a separate file, or this particular bug doesn't happen.

   main.php

   <?php
   
   final class RuntimeDataSizeCalculator{
   
   	private int $bits = 0;
   
   	protected function addBits(int $bits) : void{
   		$this->bits += $bits;
   	}
   
   	public function boundedIntAuto(int $min, int $max, int &$value) : void{
   		$this->addBits(((int) log($max - $min, 2)) + 1);
   	}
   }
   
   class Base{
   	public function __construct(){
   		$calculator = new RuntimeDataSizeCalculator();
   		$this->describeBlockOnlyState($calculator);
   	}
   
   	protected function describeBlockOnlyState(RuntimeDataSizeCalculator $w) : void{
   
   	}
   }
   
   require __DIR__ . '/test.php';
   
   $t = new Test();
   var_dump($t->getLayers());

   test.php

   <?php
   
   declare(strict_types=1);
   
   class Test extends Base{
   	public const MIN_LAYERS = 1;
   	public const MAX_LAYERS = 8;
   
   	protected int $layers = self::MIN_LAYERS;
   
   	protected function describeBlockOnlyState(RuntimeDataSizeCalculator $w) : void{
   		var_dump("wassup");
   		$w->boundedIntAuto(self::MIN_LAYERS, self::MAX_LAYERS, $this->layers);
   	}
   
   	public function getLayers() : int{
   		return $this->layers;
   	}
   }

   Outputs something like:

   string(6) "wassup"
   int(2363633267936)
   

   but should output

   string(6) "wassup"
   int(1)
   

   👍React with 👍1Reacted by Arnaud Le Blanc
3. dktapps

   changed the title [-]JIT appears not to correctly account for possible references in math operations in some cases (no reproducing test case)[/-] [+]JIT appears not to correctly account for property references in some cases[/+] on Sep 13, 2025
4. arnaud-lb

   added

   Status: Verified

   and removed

   Status: Needs Triage

   on Sep 15, 2025
5. arnaud-lb

   self-assigned this

   on Sep 15, 2025
6. arnaud-lb commented on Sep 15, 2025

   

   arnaud-lb

   on Sep 15, 2025

   Last edited by arnaud-lb

   Member

   More actions

   Smaller reproducer:

   if (time() > 0) {
       class Base {
       }
   }
   
   class Test extends Base {
   	public int $layers = 1;
   
   	public function getLayers(): int {
   		return $this->layers;
   	}
   }
   
   $t = new Test();
   $a = &$t->layers;
   var_dump($t->getLayers());
7. arnaud-lb

   closed this as completedin 32c919bon Sep 22, 2025
8. arnaud-lb

   added a commit that references this issue on Sep 22, 2025

   Handle references after FETCH_OBJ_R with REG destination

   ...

   This issue will close once commit 32c919b is merged into the 'master' branch.

   32c919b
9. arnaud-lb commented on Sep 22, 2025

   

   arnaud-lb

   on Sep 22, 2025

   Member

   More actions

   Thank you @dktapps!

   ❤️React with ❤️1Reacted by Dylan T.