[php-src] PHP-8.4: Fix GH-24396: Assertion failure in zend_jit_def_reg() "reg forwarding" with chained Pi nodes

Author: ndossche (ndossche) Date: 2026-10-23T19:59:54+02:00 Commit: https://github.com/php/php-src/commit/fc05c9bf2486d3d66593501bf78c1d83c32ecbc5 Raw diff: https://github.com/php/php-src/commit/fc05c9bf2486d3d66593501bf78c1d83c32ecbc5.diff Fix GH-24396: Assertion failure in zend_jit_def_reg() "reg forwarding" with chained Pi nodes It's possible for back-edge Pi nodes, that it gets forwarded, but due to the ordering in which BBs are generated, that at the point it wants to get forwarded that it was not generated yet. Closes GH-24403. Changed paths: A ext/opcache/tests/jit/gh24396.phpt M NEWS M ext/opcache/jit/zend_jit_ir.c Diff: diff --git a/NEWS b/NEWS index cb68d41c3332..a70e913cd499 100644 --- a/NEWS +++ b/NEWS @@ -99,6 +99,8 @@ PHP NEWS exits with an uninitialized opline). (waroad) . Fixed use-after-free in JIT ASSIGN_DIM_OP when concatenating into an empty array element. (jorgsowa) + . Fixed bug GH-24396 (Assertion failure in zend_jit_def_reg() "reg forwarding" + with chained Pi nodes). (ndossche) - PDO: . Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated. diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c index 536cef3dac70..fc38dd5647fd 100644 --- a/ext/opcache/jit/zend_jit_ir.c +++ b/ext/opcache/jit/zend_jit_ir.c @@ -1398,7 +1398,9 @@ static void zend_jit_def_reg(zend_jit_ctx *jit, zend_jit_addr addr, ir_ref val) if (dst_phi->pi >= 0) { jit->ra[src_var].ref = val; src_var = dst_phi->ssa_var; - if (!(jit->ra[src_var].flags & ZREG_FORWARD)) { + if (!(jit->ra[src_var].flags & ZREG_FORWARD) + /* Pi in a block that is not generated yet. It forwards later on its own. */ + || (jit->bb_start_ref && !jit->bb_start_ref[dst_phi->block])) { phi = zend_ssa_next_use_phi(jit->ssa, var, phi); continue; } diff --git a/ext/opcache/tests/jit/gh24396.phpt b/ext/opcache/tests/jit/gh24396.phpt new file mode 100644 index 000000000000..0ad5696b208f --- /dev/null +++ b/ext/opcache/tests/jit/gh24396.phpt @@ -0,0 +1,22 @@ +--TEST-- +GH-24396: Assertion failure in zend_jit_def_reg() "reg forwarding" with chained Pi nodes +--EXTENSIONS-- +opcache +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.file_update_protection=0 +opcache.jit=function +--FILE-- +<?php +function f() { + $i = 0; + do { + $i = ($i + 1) & 255; + } while ($i < 2 || $i > 200); + return $i; +} +var_dump(f()); +?> +--EXPECT-- +int(2)