[php-src] PR #24001: Fix GH-23991: JIT generates invalid IR for multiple recursive calls
| From: | ndossche | Date: | Tue, 29 Sep 2026 18:02:25 +0000 |
| Subject: | [php-src] PR #24001: Fix GH-23991: JIT generates invalid IR for multiple recursive calls | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38949@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24001
Author: ndossche
A direct recursive call that jumps to a RECV entry is converted into a loop back edge. The
continuation ENTRY of such a call uses the call's LOOP_END as its fake control edge. Once the
entry already was a LOOP_BEGIN with 3 inputs, a further recursive call demoted the previous LOOP_END
to an END and put it into a new MERGE. That END then had both a real successor and the fake ENTRY
edge, which violates IR assumptions. That causes assert failures in basic block handling code (merge
& fix_bb_order).
This happened in WordPress's rest_sanitize_value_from_schema(). I don't believe this
optimization was ever fully correct, doing this optimization requires more complex handling and is
certainly not worth the risk on stable branches.
The hangs that OP reports are likely because the worker crashes while holding the shm lock, or
something alike.