[php-src] PR #24402: JIT: Fix function JIT level 1 crash on FETCH_OBJ_FUNC_ARG of a hooked property
| From: | waroad | Date: | Sun, 18 Oct 2026 09:48:57 +0000 |
| Subject: | [php-src] PR #24402: JIT: Fix function JIT level 1 crash on FETCH_OBJ_FUNC_ARG of a hooked property | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39542@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24402
Author: waroad
At JIT optimization level 1 (e.g.
opcache.jit=1201), passing a property with a
get hook to a function that is only resolved at run time segfaults on the second call.
The level-1 path in zend_jit() calls the VM handler for each opcode. After
ZEND_FETCH_OBJ_R it checks whether the handler took the SIMPLE_GET fast path and pushed
the getter frame, and if so it exits to the VM. ZEND_FETCH_OBJ_FUNC_ARG uses the same
FETCH_OBJ_R handler for by-value sends, but it went through the generic default: case
without that check. The JIT'd code then carried on to SEND_FUNC_ARG while the
getter frame was active, and EX(call) was NULL.
The fix adds ZEND_FETCH_OBJ_FUNC_ARG to the ZEND_FETCH_OBJ_R case so both
get the same hook-enter guard. ext/opcache/tests/jit/gh24398.phpt is the issue's
reproducer under opcache.jit=1201. It fails without the fix (UBSan error in
ZEND_SEND_FUNC_ARG) and passes with it. The other tests in
ext/opcache/tests/jit give the same results with and without the change. With the fix,
the reproducer also runs cleanly at 1211, 1101, 1251, 1205 and tracing.
As discussed in the issue, this is the level-1 variant of GH-21006 / GH-22857. This PR targets
PHP-8.4, where property hooks were introduced.
Fixes #24398.
Found with an LLM-based testing tool; I wrote this fix with help from Claude and reviewed it myself.