[php-src] Issue #24634: Tracing JIT reads a stale stack slot at a side exit
| From: | dixyes | Date: | Sat, 24 Oct 2026 07:55:07 +0000 |
| Subject: | [php-src] Issue #24634: Tracing JIT reads a stale stack slot at a side exit | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-253151@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/24634
Author: dixyes
### Description
opcache.jit=tracing miscompiles a function that reads a variable in one branch and
assigns a constant to the same variable in another branch.
The else branch uses $exponent = 113 instead of the input exponent, so
every normal input gives a wrong result.
0x0400 must give 0x38800000, but gives 0x70800000.
opcache.jit=function and opcache.jit=off give correct results.
The effect is silent wrong numeric results. PHP 8.5.11 NTS, 8.7.0-dev ZTS, and master
4a51e519 give the same wrong bits.
### PHP Version
```plain
PHP 8.5.11 NTS, 8.7.0-dev ZTS, and master 4a51e519
```
### Operating System
_No response_