[php-src] PHP-8.5: Fix GH-20890: Segfault in zval_undefined_cv with non-simple property hook with minimal tracing JIT

Author: Nora Dossche (ndossche) Committer: ndossche (ndossche) Date: 2026-10-06T22:14:47+02:00 Commit: https://github.com/php/php-src/commit/36037a10eca576f20829eb54197ac2b29dd3f5ea Raw diff: https://github.com/php/php-src/commit/36037a10eca576f20829eb54197ac2b29dd3f5ea.diff Fix GH-20890: Segfault in zval_undefined_cv with non-simple property hook with minimal tracing JIT This is similar to f6c2e40a11 but for minimal JIT + tracing JIT. Most of the times the tracing JIT shouldn't rely on going to the VM, but in some cases, like in minimal JIT, it can and then it hits the same bug. Closes GH-20897. Changed paths: A ext/opcache/tests/jit/gh20890.phpt M NEWS M ext/opcache/jit/zend_jit_trace.c Diff: diff --git a/NEWS b/NEWS index f335182cb1e1..34db44b5c894 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,9 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? ????, PHP 8.4.28 +- Opcache: + . Fixed bug GH-20890 (Segfault in zval_undefined_cv with non-simple property + hook with minimal tracing JIT). (ndossche) 22 Oct 2026, PHP 8.4.27 diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c index 6a3e8c3a4711..5aa62d2e0878 100644 --- a/ext/opcache/jit/zend_jit_trace.c +++ b/ext/opcache/jit/zend_jit_trace.c @@ -333,6 +333,14 @@ static int zend_jit_trace_may_exit(const zend_op_array *op_array, const zend_op // TODO: recompilation may change target ??? return 0; #endif + case ZEND_FETCH_OBJ_R: + if (opline->op2_type == IS_CONST) { + const zend_class_entry *ce = opline->op1_type == IS_UNUSED ? op_array->scope : NULL; + if (!ce || !(ce->ce_flags & ZEND_ACC_FINAL) || ce->num_hooked_props > 0) { + return 1; + } + } + break; case ZEND_RETURN_BY_REF: case ZEND_RETURN: /* return */ diff --git a/ext/opcache/tests/jit/gh20890.phpt b/ext/opcache/tests/jit/gh20890.phpt new file mode 100644 index 000000000000..c375c379fcc7 --- /dev/null +++ b/ext/opcache/tests/jit/gh20890.phpt @@ -0,0 +1,37 @@ +--TEST-- +GH-20890 (Segfault in zval_undefined_cv with non-simple property hook with minimal tracing JIT) +--CREDITS-- +Moonster8282 +--EXTENSIONS-- +opcache +--INI-- +opcache.jit=1251 +--FILE-- +<?php +class HookJIT { + private int $readCount = 0; + + public int $computed { + get { + $this->readCount++; + return $this->readCount * 2; + } + } +} + +function hook_hot_path($obj, $iterations) { + $sum = 0; + for ($i = 0; $i < $iterations; $i++) { + $sum += $obj->computed; + } + return $sum; +} + +echo "Testing property hook in hot path...\n"; +$obj = new HookJIT(); +$result = hook_hot_path($obj, 100); +echo "Result: $result\n"; +?> +--EXPECT-- +Testing property hook in hot path... +Result: 10100