[php-src] PR #24155: Fix GH-24154: Function JIT ++/-- on typed property holding a reference
| From: | lazerg | Date: | Tue, 06 Oct 2026 07:53:56 +0000 |
| Subject: | [php-src] PR #24155: Fix GH-24154: Function JIT ++/-- on typed property holding a reference | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39195@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24155
Author: lazerg
Since 1b2bde474ab,
zend_jit_inc_typed_prop() and zend_jit_dec_typed_prop()
only deref the copy, so var_ptr still points at the reference. The type check then
fails on the reference itself, and the error path destroys it and overwrites the property slot. This
puts the ZVAL_DEREF(var_ptr) back. The regression is only on master.
Fixes GH-24154