[php-src] master: Merge branch 'PHP-8.6'

Author: ndossche (ndossche) Date: 2026-10-06T22:17:14+02:00 Commit: https://github.com/php/php-src/commit/c676df53be213f354eb371c7cf9d987c823d7e6c Raw diff: https://github.com/php/php-src/commit/c676df53be213f354eb371c7cf9d987c823d7e6c.diff Merge branch 'PHP-8.6' * PHP-8.6: Fix GH-20890: Segfault in zval_undefined_cv with non-simple property hook with minimal tracing JIT Changed paths: A ext/opcache/tests/jit/gh20890.phpt M ext/opcache/jit/zend_jit_ir.c M ext/opcache/jit/zend_jit_trace.c Diff: diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c index 966fe68f3897..9505e7997cff 100644 --- a/ext/opcache/jit/zend_jit_ir.c +++ b/ext/opcache/jit/zend_jit_ir.c @@ -17281,7 +17281,9 @@ static int zend_jit_trace_handler(zend_jit_ctx *jit, const zend_op_array *op_arr opline->opcode == ZEND_DO_FCALL_BY_NAME || opline->opcode == ZEND_DO_FCALL || opline->opcode == ZEND_GENERATOR_CREATE || - opline->opcode == ZEND_INCLUDE_OR_EVAL) { + opline->opcode == ZEND_INCLUDE_OR_EVAL || + /* May enter a simple get hook. */ + opline->opcode == ZEND_FETCH_OBJ_R) { jit_STORE_IP(jit, ir_AND_A(ref, ir_CONST_ADDR(~ZEND_VM_ENTER_BIT))); } else { diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c index 68461973f3f2..748ede31a0a0 100644 --- a/ext/opcache/jit/zend_jit_trace.c +++ b/ext/opcache/jit/zend_jit_trace.c @@ -348,6 +348,14 @@ static int zend_jit_trace_may_exit(const zend_op_array *op_array, const zend_op // TODO: recompilation may change target ??? return 0; #endif + case ZEND_FETCH_OBJ_R: + if (opline->op2_type == IS_CONST) { + const zend_class_entry *ce = opline->op1_type == IS_UNUSED ? op_array->scope : NULL; + if (!ce || !(ce->ce_flags & ZEND_ACC_FINAL) || ce->num_hooked_props > 0) { + return 1; + } + } + break; case ZEND_RETURN_BY_REF: case ZEND_RETURN: /* return */ diff --git a/ext/opcache/tests/jit/gh20890.phpt b/ext/opcache/tests/jit/gh20890.phpt new file mode 100644 index 000000000000..c375c379fcc7 --- /dev/null +++ b/ext/opcache/tests/jit/gh20890.phpt @@ -0,0 +1,37 @@ +--TEST-- +GH-20890 (Segfault in zval_undefined_cv with non-simple property hook with minimal tracing JIT) +--CREDITS-- +Moonster8282 +--EXTENSIONS-- +opcache +--INI-- +opcache.jit=1251 +--FILE-- +<?php +class HookJIT { + private int $readCount = 0; + + public int $computed { + get { + $this->readCount++; + return $this->readCount * 2; + } + } +} + +function hook_hot_path($obj, $iterations) { + $sum = 0; + for ($i = 0; $i < $iterations; $i++) { + $sum += $obj->computed; + } + return $sum; +} + +echo "Testing property hook in hot path...\n"; +$obj = new HookJIT(); +$result = hook_hot_path($obj, 100); +echo "Result: $result\n"; +?> +--EXPECT-- +Testing property hook in hot path... +Result: 10100