Bug #81409 [Asn->Csd]: Incorrect JIT code for ADD with a reference to array
| From: | git@php.net | Date: | Thu, 02 Sep 2021 08:18:06 +0000 |
| Subject: | Bug #81409 [Asn->Csd]: Incorrect JIT code for ADD with a reference to array | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-236374@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=81409&edit=1
ID: 81409
Updated by: git@php.net
Reported by: dmitry@php.net
Summary: Incorrect JIT code for ADD with a reference to array
-Status: Assigned
+Status: Closed
Type: Bug
Package: JIT
Operating System: *
PHP Version: 8.1Git-2021-09-02 (Git)
Assigned To: dmitry
Block user comment: N
Private report: N
New Comment:
Automatic comment on behalf of dstogov
Revision: https://github.com/php/php-src/commit/cbc925e510fd04f18538e98ce532c67ea5840196
Log: Fixed bug #81409 (Incorrect JIT code for ADD with a reference to array)
Previous Comments:
------------------------------------------------------------------------
[2021-09-02 07:50:49] dmitry@php.net
Description:
------------
Tracing JIT doesn't take into account the dereference and pass into
zend_jit_add_arrays_helper() a reference instead of array.
Test script:
---------------
<?php
function foo(&$a) {
$n = count($a);
$a = $a + [$n=>1];
}
function bar() {
$x = [];
for ($i = 0; $i < 200; $i++) {
foo($x);
}
var_dump(count($x));
}
bar();
?>
Expected result:
----------------
int(200)
Actual result:
--------------
int(1) or crash, assertion, ASAN failure
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=81409&edit=1