[php-src] PR #24419: Fix GH-24397: Clear vacated MERGE inputs in _zend_jit_fix_merges()
| From: | iliaal | Date: | Sun, 18 Oct 2026 20:22:45 +0000 |
| Subject: | [php-src] PR #24419: Fix GH-24397: Clear vacated MERGE inputs in _zend_jit_fix_merges() | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39573@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24419
Author: iliaal
_zend_jit_fix_merges() compacts a MERGE's live inputs to the left without clearing
the slots it vacates. When one input survives, the node becomes a BEGIN whose op2 is a label
operand, so the stale END ref is read as a label: ir_save() asserts on it in debug
builds when opcache.jit_debug sets an IR dump bit, and in all builds the aliasing load
and store searches treat the block as address-taken and stop there. PHI compaction reads only up to
inputs_count, and the PHI-to-COPY conversion already overwrites op2.
Fixes #24397