Bug #81409 [NEW]: Incorrect JIT code for ADD with a reference to array

From: dmitry Operating system: * PHP version: 8.1Git-2021-09-02 (Git) Package: JIT Bug Type: Bug Bug description:Incorrect JIT code for ADD with a reference to array Description: ------------ Tracing JIT doesn't take into account the dereference and pass into zend_jit_add_arrays_helper() a reference instead of array. Test script: --------------- <?php function foo(&$a) { $n = count($a); $a = $a + [$n=>1]; } function bar() { $x = []; for ($i = 0; $i < 200; $i++) { foo($x); } var_dump(count($x)); } bar(); ?> Expected result: ---------------- int(200) Actual result: -------------- int(1) or crash, assertion, ASAN failure -- Edit bug report at https://bugs.php.net/bug.php?id=81409&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=81409&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=81409&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=81409&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=81409&r=needscript Try newer version: https://bugs.php.net/fix.php?id=81409&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=81409&r=support Expected behavior: https://bugs.php.net/fix.php?id=81409&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=81409&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=81409&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=81409&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=81409&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=81409&r=dst IIS Stability: https://bugs.php.net/fix.php?id=81409&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=81409&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=81409&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=81409&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=81409&r=mysqlcfg