Bug #80786 [Ver->Csd]: PHP crash using JIT

Edit report at https://bugs.php.net/bug.php?id=80786&edit=1 ID: 80786 Updated by: nikic@php.net Reported by: gfpuba+phpbug at gmail dot com Summary: PHP crash using JIT -Status: Verified +Status: Closed Type: Bug Package: JIT PHP Version: 8.0.3RC1 Assigned To: dmitry Block user comment: N Private report: N New Comment: Automatic comment on behalf of nikita.ppv@gmail.com Revision: http://git.php.net/?p=php-src.git;a=commit;h=79cf2c56d3c95b184fbdbe2a9bc4afe7bb0dc557 Log: Fixed bug #80786 Previous Comments: ------------------------------------------------------------------------ [2021-02-23 09:05:26] nikic@php.net Reproduces on Linux as well (-d opcache.jit=function). .L8: cmp $0x5, 0x8(%rax) jnz .L9 vmovsd (%rax), %xmm0 mov $0xa, %rax vxorps %xmm1, %xmm1, %xmm1 vcvtsi2sd %rax, %xmm1, %xmm1 vsubsd %xmm1, %xmm0, %xmm0 vmovsd %xmm0, (%rax) jmp .L2 Looks like we're clobbering %rax. ------------------------------------------------------------------------ [2021-02-23 03:21:51] gfpuba+phpbug at gmail dot com Clarification: This is this statement that causes PHP to crash: $this->value -= 10; ------------------------------------------------------------------------ [2021-02-23 00:14:00] gfpuba+phpbug at gmail dot com Description: ------------ When JIT is enabled, running this code using PHP CLI or with Apache 2.4 results in a crash. The program runs fine without JIT I am running the 64bit version It fails with all php 8 versions Test script: --------------- <?php $a = new Test(); $a->TestFunc(); $a = false; echo 'Program terminated'; class Test{ private $value = 11.3; public function TestFunc(){ $this->value -= 10; } } Expected result: ---------------- Displays Program terminated Actual result: -------------- crash in PHP ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=80786&edit=1