Skip to content

Commit c60c2a0

Browse files
dstogovdstogov
authored
Backport fix for phpGH-12512: JIT Assertion `info & (1 << type)' failed (php#12660)
1 parent 6a43135 commit c60c2a0

File tree

3 files changed

+154
-3
lines changed

3 files changed

+154
-3
lines changed

‎ext/opcache/jit/zend_jit_trace.c‎

Lines changed: 69 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5022,6 +5022,21 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
50225022
zend_may_throw_ex(opline, ssa_op, op_array, ssa, op1_info, op2_info))) {
50235023
goto jit_failure;
50245024
}
5025+
if (ssa_op->op2_def > 0
5026+
&& Z_MODE(op2_addr) == IS_REG
5027+
&& ssa->vars[ssa_op->op2_def].no_val) {
5028+
uint8_t type = (op2_info & MAY_BE_LONG) ? IS_LONG : IS_DOUBLE;
5029+
uint32_t var_num = EX_VAR_TO_NUM(opline->op2.var);
5030+
5031+
if (STACK_MEM_TYPE(stack, var_num) != type
5032+
&& ssa->vars[ssa_op->op2_def].use_chain < 0
5033+
&& !ssa->vars[ssa_op->op2_def].phi_use_chain) {
5034+
if (!zend_jit_store_var_type(&dasm_state, var_num, type)) {
5035+
return 0;
5036+
}
5037+
SET_STACK_TYPE(stack, var_num, type, 1);
5038+
}
5039+
}
50255040
if (opline->op2_type == IS_CV
50265041
&& ssa_op->op2_def >= 0
50275042
&& ssa->vars[ssa_op->op2_def].alias == NO_ALIAS) {
@@ -5058,6 +5073,21 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
50585073
res_use_info, res_info, res_addr)) {
50595074
goto jit_failure;
50605075
}
5076+
if (ssa_op->op1_def > 0
5077+
&& Z_MODE(op1_addr) == IS_REG
5078+
&& ssa->vars[ssa_op->op1_def].no_val) {
5079+
uint8_t type = (op1_info & MAY_BE_LONG) ? IS_LONG : IS_DOUBLE;
5080+
uint32_t var_num = EX_VAR_TO_NUM(opline->op1.var);
5081+
5082+
if (STACK_MEM_TYPE(stack, var_num) != type
5083+
&& ssa->vars[ssa_op->op1_def].use_chain < 0
5084+
&& !ssa->vars[ssa_op->op1_def].phi_use_chain) {
5085+
if (!zend_jit_store_var_type(&dasm_state, var_num, type)) {
5086+
return 0;
5087+
}
5088+
SET_STACK_TYPE(stack, var_num, type, 1);
5089+
}
5090+
}
50615091
if (opline->op1_type == IS_CV
50625092
&& ssa_op->op1_def >= 0
50635093
&& ssa->vars[ssa_op->op1_def].alias == NO_ALIAS) {
@@ -5140,6 +5170,21 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
51405170
op1_info, op1_addr, op1_def_addr)) {
51415171
goto jit_failure;
51425172
}
5173+
if (ssa_op->op1_def > 0
5174+
&& Z_MODE(op1_addr) == IS_REG
5175+
&& ssa->vars[ssa_op->op1_def].no_val) {
5176+
uint8_t type = (op1_info & MAY_BE_LONG) ? IS_LONG : IS_DOUBLE;
5177+
uint32_t var_num = EX_VAR_TO_NUM(opline->op1.var);
5178+
5179+
if (STACK_MEM_TYPE(stack, var_num) != type
5180+
&& ssa->vars[ssa_op->op1_def].use_chain < 0
5181+
&& !ssa->vars[ssa_op->op1_def].phi_use_chain) {
5182+
if (!zend_jit_store_var_type(&dasm_state, var_num, type)) {
5183+
return 0;
5184+
}
5185+
SET_STACK_TYPE(stack, var_num, type, 1);
5186+
}
5187+
}
51435188
if (opline->op1_type == IS_CV
51445189
&& ssa_op->op1_def >= 0
51455190
&& ssa->vars[ssa_op->op1_def].alias == NO_ALIAS) {
@@ -6872,9 +6917,30 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
68726917
}
68736918
} else if (p->stop == ZEND_JIT_TRACE_STOP_LINK
68746919
|| p->stop == ZEND_JIT_TRACE_STOP_INTERPRETER) {
6875-
if (!zend_jit_trace_deoptimization(&dasm_state, 0, NULL,
6876-
stack, op_array->last_var + op_array->T, NULL, NULL, NULL, 0)) {
6877-
goto jit_failure;
6920+
if (ra
6921+
&& (p-1)->op != ZEND_JIT_TRACE_ENTER
6922+
&& (p-1)->op != ZEND_JIT_TRACE_BACK
6923+
&& opline->opcode != ZEND_DO_UCALL
6924+
&& opline->opcode != ZEND_DO_FCALL
6925+
&& opline->opcode != ZEND_DO_FCALL_BY_NAME
6926+
&& opline->opcode != ZEND_INCLUDE_OR_EVAL) {
6927+
if (!zend_jit_trace_deoptimization(&dasm_state, 0, NULL,
6928+
stack, op_array->last_var + op_array->T, NULL, NULL, NULL, 0)) {
6929+
goto jit_failure;
6930+
}
6931+
for (i = 0; i < op_array->last_var; i++) {
6932+
int8_t reg = STACK_REG(stack, i);
6933+
uint8_t type = STACK_TYPE(stack, i);
6934+
6935+
if (reg == ZREG_NONE
6936+
&& type != IS_UNKNOWN
6937+
&& type != STACK_MEM_TYPE(stack, i)) {
6938+
if (!zend_jit_store_var_type(&dasm_state, i, type)) {
6939+
return 0;
6940+
}
6941+
SET_STACK_TYPE(stack, i, type, 1);
6942+
}
6943+
}
68786944
}
68796945
if (p->stop == ZEND_JIT_TRACE_STOP_LINK) {
68806946
const void *timeout_exit_addr = NULL;

‎ext/opcache/tests/jit/gh12512.phpt‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
--TEST--
2+
GH-12512: missing type store
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
--FILE--
7+
<?php
8+
function bar(array &$a): ?bool {
9+
$ret = null;
10+
foreach ($a as $key => $val) {
11+
if ($val === 2) {
12+
unset($a[$key]);
13+
}
14+
}
15+
return $ret;
16+
}
17+
18+
function foo($a, bool $b): bool {
19+
if ($b) return true;
20+
$n2 = count($a);
21+
do {
22+
$n = $n2;
23+
$res = bar($a);
24+
$n2 = count($a);
25+
} while ($res === null && $n !== $n2);
26+
27+
if ($res === null && $n === 0) {
28+
return false;
29+
}
30+
return true;
31+
}
32+
33+
$a = [1,'a'=>5];
34+
bar($a);
35+
foo([1,'a'=>5], true);
36+
foo([1,'a'=>5], false);
37+
foo([2,'a'=>5], false);
38+
?>
39+
DONE
40+
--EXPECT--
41+
DONE

‎ext/opcache/tests/jit/gh12512_2.phpt‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
--TEST--
2+
GH-12512: missing type store
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
--FILE--
7+
<?php
8+
function foo(array $a, $exit) {
9+
$n = 0;
10+
11+
$count = count($a);
12+
if ($count == 0) {
13+
return 0;
14+
}
15+
$a2 = [];
16+
foreach ($a as $v) {
17+
$a2[] = $v;
18+
}
19+
20+
$count = $a2[5];
21+
22+
for ($i = 0; $i < $count; $i++) {
23+
$x = $a[$i];
24+
for ($k = $i + 1; $k < $count; $k++) {
25+
$y = $a[$k];
26+
$n += $x > $y;
27+
}
28+
if ($exit) {
29+
return $n;
30+
}
31+
}
32+
33+
return $n;
34+
}
35+
var_dump(foo([1,2,3,4,5,6,7,8], 1));
36+
var_dump(foo([1,2,3,4,5,6,7,8], 1));
37+
var_dump(foo([1,2,3,4,5,6,7,8], 0));
38+
?>
39+
DONE
40+
--EXPECT--
41+
int(0)
42+
int(0)
43+
int(0)
44+
DONE

0 commit comments

Comments
 (0)