[php-src] PR #25250: Fix GH-25247: Tracing JIT used a stale value for argument 13+
| From: | rafamolina1 | Date: | Fri, 06 Nov 2026 20:02:18 +0000 |
| Subject: | [php-src] PR #25250: Fix GH-25247: Tracing JIT used a stale value for argument 13+ | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40362@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25250
Author: rafamolina1
## Summary
- Tracing JIT left a long or double from
QM_ASSIGN in a register when
SEND_VAL_EX / SEND_VAR_EX / SEND_VAR_NO_REF_EX for argument
13+ fell back to the VM handler. The handler reads the stack slot, so the callee saw the previous
value of that temporary.
- Spill that operand before the handler. zend_jit_store_var_if_necessary() does not,
because the allocator marks the use ZREG_LAST_USE rather than ZREG_STORE.
- SEND_VAL_EX above MAX_ARG_FLAG_NUM is no longer treated as an opcode
that can keep its operand only in a register.
Fixes GH-25247.
## Test plan
- [x] ext/opcache/tests/jit/gh25247.phpt fails on unpatched PHP 8.3 with
opcache.jit=tracing (argument 13 is a stale integer) and passes with this patch
- [x] The same script passes with opcache.jit=function and opcache.jit=off
- [x] ext/opcache/tests passes under function JIT and tracing JIT
- [x] ext/opcache/tests/jit passes under ASAN, ZTS, and debug with tracing JIT