[php-src] PR #24342: Fix GH-24337: JIT segfault when decrementing a non-numeric string property
| From: | lazerg | Date: | Thu, 15 Oct 2026 05:18:29 +0000 |
| Subject: | [php-src] PR #24342: Fix GH-24337: JIT segfault when decrementing a non-numeric string property | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39456@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24342
Author: lazerg
zend_jit_incdec_obj() calls
increment_function()/decrement_function() for a non-long untyped property
without storing EX(opline) first. When the value is a non-numeric string, the
deprecation goes through zend_error(), which reads the stale opline in
zend_get_executed_lineno() and crashes. The non-long path now sets the opline and
checks for an exception whenever the value can be anything other than a long or double, since a user
error handler can also throw from that warning.
Fixes #24337