Bug #79743 [Opn->Csd]: Fatal error when assigning to array property with JIT enabled

Edit report at https://bugs.php.net/bug.php?id=79743&edit=1 ID: 79743 Updated by: laruence@php.net Reported by: theodorejb@php.net Summary: Fatal error when assigning to array property with JIT enabled -Status: Open +Status: Closed Type: Bug Package: opcache Operating System: Windows 10 x64 build 2004 PHP Version: 8.0.0alpha1 Block user comment: N Private report: N New Comment: Automatic comment on behalf of laruence@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=d005a8e92becb9993ab0d370e4f5688d09bcaaf2 Log: Fixed bug #79743 (Fatal error when assigning to array property with JIT enabled) Previous Comments: ------------------------------------------------------------------------ [2020-06-26 14:50:09] theodorejb@php.net Description: ------------ Running php-8.0.0alpha1-nts-Win32-vs16-x64 JIT settings: opcache.jit_buffer_size=200000000 opcache.jit=1235 When an array contains a bunch of objects with a typed array property, and the objects are looped over and a value is assigned to a non-consecutive key in the typed array property, a fatal error occurs after a few iterations. Note: I wasn't able to reproduce the error if the array contains 30 or fewer objects. It only seems to occur when there are at least 31 objects, and the more objects are in the array the fewer iterations are successful before the error occurs. Test script: --------------- <?php class Foo { public array $things = []; } $objects = []; for ($i = 0; $i < 70; $i++) { $objects[] = new Foo(); } foreach ($objects as $key => $class) { echo $key . '<br/>'; $class->things[1] = true; } Actual result: -------------- Fatal error: Uncaught TypeError: Cannot auto-initialize an array inside property Foo::$things of type array in test.php:16 Stack trace: #0 {main} thrown in test.php on line 16 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=79743&edit=1