[php-src] PR #24402: JIT: Fix function JIT level 1 crash on FETCH_OBJ_FUNC_ARG of a hooked property

From: Date: Sun, 18 Oct 2026 09:48:57 +0000
Subject: [php-src] PR #24402: JIT: Fix function JIT level 1 crash on FETCH_OBJ_FUNC_ARG of a hooked property
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-39542@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/24402 Author: waroad At JIT optimization level 1 (e.g. opcache.jit=1201), passing a property with a get hook to a function that is only resolved at run time segfaults on the second call. The level-1 path in zend_jit() calls the VM handler for each opcode. After ZEND_FETCH_OBJ_R it checks whether the handler took the SIMPLE_GET fast path and pushed the getter frame, and if so it exits to the VM. ZEND_FETCH_OBJ_FUNC_ARG uses the same FETCH_OBJ_R handler for by-value sends, but it went through the generic default: case without that check. The JIT'd code then carried on to SEND_FUNC_ARG while the getter frame was active, and EX(call) was NULL. The fix adds ZEND_FETCH_OBJ_FUNC_ARG to the ZEND_FETCH_OBJ_R case so both get the same hook-enter guard. ext/opcache/tests/jit/gh24398.phpt is the issue's reproducer under opcache.jit=1201. It fails without the fix (UBSan error in ZEND_SEND_FUNC_ARG) and passes with it. The other tests in ext/opcache/tests/jit give the same results with and without the change. With the fix, the reproducer also runs cleanly at 1211, 1101, 1251, 1205 and tracing. As discussed in the issue, this is the level-1 variant of GH-21006 / GH-22857. This PR targets PHP-8.4, where property hooks were introduced. Fixes #24398. Found with an LLM-based testing tool; I wrote this fix with help from Claude and reviewed it myself.

« previous php.git-pulls (#39542) next »