[php-src] master: Tracing JIT: give the type guard on entry of an inlined call an exit opline

Author: waroad (waroad) Committer: ndossche (ndossche) Date: 2026-10-22T15:00:17+02:00 Commit: https://github.com/php/php-src/commit/b4ca62e3178c63a75b42c3dee3a423849dff3f39 Raw diff: https://github.com/php/php-src/commit/b4ca62e3178c63a75b42c3dee3a423849dff3f39.diff Tracing JIT: give the type guard on entry of an inlined call an exit opline Assisted-by: Claude Closes GH-24411. Changed paths: A ext/opcache/tests/jit/gh24389.phpt M NEWS M ext/opcache/jit/zend_jit_trace.c Diff: diff --git a/NEWS b/NEWS index 3d8db871d6ca..599891f3b598 100644 --- a/NEWS +++ b/NEWS @@ -85,6 +85,8 @@ PHP NEWS zend_jit_assign_dim_op()). (waroad) . Fixed bug GH-24398 (JIT: minimal JIT segfault when a hooked property is passed to a run-time-resolved function). (waroad) + . Fixed bug GH-24389 (Tracing JIT: type guard on entry of an inlined call + exits with an uninitialized opline). (waroad) - PDO: . Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated. diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c index 7c218a62306c..dc0ae8eea511 100644 --- a/ext/opcache/jit/zend_jit_trace.c +++ b/ext/opcache/jit/zend_jit_trace.c @@ -6887,7 +6887,7 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par ssa->var_info[j].type &= ~MAY_BE_GUARD; op_type = concrete_type(ssa->var_info[j].type); - if (!zend_jit_type_guard(&ctx, NULL, EX_NUM_TO_VAR(i), op_type)) { + if (!zend_jit_type_guard(&ctx, (p+1)->opline, EX_NUM_TO_VAR(i), op_type)) { goto jit_failure; } SET_STACK_TYPE(stack, i, op_type, 1); diff --git a/ext/opcache/tests/jit/gh24389.phpt b/ext/opcache/tests/jit/gh24389.phpt new file mode 100644 index 000000000000..8c8d5725f614 --- /dev/null +++ b/ext/opcache/tests/jit/gh24389.phpt @@ -0,0 +1,30 @@ +--TEST-- +GH-24389 (Tracing JIT: type guard on entry of an inlined call exits with an uninitialized opline) +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.file_update_protection=0 +opcache.jit_buffer_size=64M +opcache.jit=tracing +--EXTENSIONS-- +opcache +--FILE-- +<?php +function right($x, $y) { + $a = $x + $y; + return $x - $y; +} +function driver($x, $y) { + $xr = &$x; + $yr = &$y; + for ($i = 0; $i < 300; $i++) { + $r = right($x, $y); + } + return $r; +} +var_dump(driver(3, 2)); +var_dump(driver(3.5, 2.5)); +?> +--EXPECT-- +int(1) +float(1)