[php-src] master: Merge branch 'PHP-8.6'

Author: ndossche (ndossche) Date: 2026-10-22T10:47:52+02:00 Commit: https://github.com/php/php-src/commit/68efc09321820256d519365ffe6b5fce1bcd2bbf Raw diff: https://github.com/php/php-src/commit/68efc09321820256d519365ffe6b5fce1bcd2bbf.diff Merge branch 'PHP-8.6' * PHP-8.6: JIT: Fix function JIT level 1 crash on FETCH_OBJ_FUNC_ARG of a hooked property Changed paths: A ext/opcache/tests/jit/gh24398.phpt A ext/opcache/tests/jit/gh24398_002.phpt M ext/opcache/jit/zend_jit.c M ext/opcache/jit/zend_jit_ir.c M ext/opcache/jit/zend_jit_trace.c Diff: diff --git a/ext/opcache/jit/zend_jit.c b/ext/opcache/jit/zend_jit.c index cd8c02097e99..bd16e3abc3e4 100644 --- a/ext/opcache/jit/zend_jit.c +++ b/ext/opcache/jit/zend_jit.c @@ -2884,6 +2884,8 @@ static int zend_jit(const zend_op_array *op_array, zend_ssa *ssa, const zend_op call_level--; } break; + /* FETCH_OBJ_FUNC_ARG may dispatch into the FETCH_OBJ_R handler (if sent by value). */ + case ZEND_FETCH_OBJ_FUNC_ARG: case ZEND_FETCH_OBJ_R: if (!zend_jit_handler(&ctx, opline, zend_may_throw(opline, ssa_op, op_array, ssa))) { diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c index 49bbe0c14c0e..69b57bfdc8a3 100644 --- a/ext/opcache/jit/zend_jit_ir.c +++ b/ext/opcache/jit/zend_jit_ir.c @@ -17367,7 +17367,8 @@ static int zend_jit_trace_handler(zend_jit_ctx *jit, const zend_op_array *op_arr opline->opcode == ZEND_GENERATOR_CREATE || opline->opcode == ZEND_INCLUDE_OR_EVAL || /* May enter a simple get hook. */ - opline->opcode == ZEND_FETCH_OBJ_R) { + opline->opcode == ZEND_FETCH_OBJ_R || + opline->opcode == ZEND_FETCH_OBJ_FUNC_ARG) { jit_STORE_IP(jit, ir_AND_A(ref, ir_CONST_ADDR(~ZEND_VM_ENTER_BIT))); } else { @@ -17395,7 +17396,8 @@ static int zend_jit_trace_handler(zend_jit_ctx *jit, const zend_op_array *op_arr opline->opcode == ZEND_GENERATOR_CREATE || opline->opcode == ZEND_INCLUDE_OR_EVAL || /* May enter a simple get hook. */ - opline->opcode == ZEND_FETCH_OBJ_R) { + opline->opcode == ZEND_FETCH_OBJ_R || + opline->opcode == ZEND_FETCH_OBJ_FUNC_ARG) { ir_ref addr = jit_EG(current_execute_data); diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c index f95b8bf119fe..04f312c906ee 100644 --- a/ext/opcache/jit/zend_jit_trace.c +++ b/ext/opcache/jit/zend_jit_trace.c @@ -348,6 +348,8 @@ static int zend_jit_trace_may_exit(const zend_op_array *op_array, const zend_op // TODO: recompilation may change target ??? return 0; #endif + /* FETCH_OBJ_FUNC_ARG may dispatch into the FETCH_OBJ_R handler (if sent by value). */ + case ZEND_FETCH_OBJ_FUNC_ARG: case ZEND_FETCH_OBJ_R: if (opline->op2_type == IS_CONST) { const zend_class_entry *ce = opline->op1_type == IS_UNUSED ? op_array->scope : NULL; diff --git a/ext/opcache/tests/jit/gh24398.phpt b/ext/opcache/tests/jit/gh24398.phpt new file mode 100644 index 000000000000..948ac8f1b261 --- /dev/null +++ b/ext/opcache/tests/jit/gh24398.phpt @@ -0,0 +1,36 @@ +--TEST-- +GH-24398: Function JIT level 1 crash on FETCH_OBJ_FUNC_ARG of a hooked property +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.jit_buffer_size=64M +opcache.jit=1201 +--EXTENSIONS-- +opcache +--FILE-- +<?php + +class C { + public $prop { + get => 5; + } +} + +if (true) { + function g($x) { + return $x; + } +} + +function f($o) { + return g($o->prop); +} + +$c = new C(); +var_dump(f($c)); +var_dump(f($c)); + +?> +--EXPECT-- +int(5) +int(5) diff --git a/ext/opcache/tests/jit/gh24398_002.phpt b/ext/opcache/tests/jit/gh24398_002.phpt new file mode 100644 index 000000000000..b8b0c0481c77 --- /dev/null +++ b/ext/opcache/tests/jit/gh24398_002.phpt @@ -0,0 +1,44 @@ +--TEST-- +GH-24398 (tracing): FETCH_OBJ_FUNC_ARG of a hooked property with unknown send mode +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.jit_buffer_size=64M +opcache.jit=tracing +opcache.jit_hot_loop=1 +--EXTENSIONS-- +opcache +--FILE-- +<?php + +class A { + public $prop = 5; +} + +class B { + public $prop { + get => 5; + } +} + +if (true) { + function g($x) { + return $x; + } +} + +function f($o) { + // The named argument leaves the send mode unknown to the tracing JIT, + // so FETCH_OBJ_FUNC_ARG is executed by the VM handler. + return g(x: $o->prop); +} + +$sum = 0; +foreach ([new A, new A, new A, new B, new B, new B] as $o) { + $sum += f($o); +} +var_dump($sum); + +?> +--EXPECT-- +int(30)