[php-src] Issue #12380: JIT+Isset on a private property inside fiber accesses private property in child class
| From: | danog | Date: | Sat, 07 Oct 2023 20:47:28 +0000 |
| Subject: | [php-src] Issue #12380: JIT+Isset on a private property inside fiber accesses private property in child class | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-245514@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/12380
Author: danog
### Description
The following code:
>php -d opcache.enable_cli=1 -d opcache.jit=tracing -d opcache.jit_buffer_size=1G -d
>opcache.jit_max_root_traces=1000000 -d opcache.jit_max_side_traces=1000000 -d
>opcache.jit_max_exit_counters=1000000 -d opcache.jit_hot_loop=1 -d opcache.jit_hot_func=1 -d
>opcache.jit_hot_return=1 -d opcache.jit_hot_side_exit=1 -d memory_limit=-1 a.php
```php
<?php
abstract class a
{
private array $v = [];
public function __construct()
{
$this->v['a'] = 'test';
}
public function test(): void
{
$f = new \Fiber(function (): void {
if (!isset($this->v['a'])) {
throw new AssertionError("Impossible");
}
});
$f->start();
}
}
final class b extends a {
private array $v = [];
}
$a = new b;
for ($i = 0; $i < 30; $i++) {
$a->test();
}
```
Resulted in this output:
```
PHP Fatal error: Uncaught AssertionError: Impossible in /home/daniil/repos/amp/a.php:16
Stack trace:
#0 [internal function]: a->{closure}()
#1 /home/daniil/repos/amp/a.php(19): Fiber->start()
#2 /home/daniil/repos/amp/a.php(29): a->test()
#3 {main}
thrown in /home/daniil/repos/amp/a.php on line 16
```
But I expected this output instead:
```
```
This is the root cause of https://github.com/php/php-src/issues/12249
Ping @dstogov
### PHP Version
8.2.11
### Operating System
Arch linux