Fixed GH-12585: Assertion t->stack_map[t->exit_info[exit_point].stack_offset + var].type == 4

Author: dstogov

ext/opcache/jit/zend_jit_trace.c

@@ -2850,9 +2850,11 @@ static zend_jit_reg_var* zend_jit_trace_allocate_registers(zend_jit_trace_rec *t
 			}
 
 			if (ssa_op->op1_use >= 0
-			 && RA_HAS_IVAL(ssa_op->op1_use)
-			 && !zend_ssa_is_no_val_use(opline, ssa_op, ssa_op->op1_use)) {
-				if (support_opline) {
+			 && RA_HAS_IVAL(ssa_op->op1_use)) {
+				if (!support_opline) {
+					RA_IVAL_DEL(ssa_op->op1_use);
+					count--;
+				} else if (!zend_ssa_is_no_val_use(opline, ssa_op, ssa_op->op1_use)) {
 					zend_jit_trace_use_var(idx, ssa_op->op1_use, ssa_op->op1_def, ssa_op->op1_use_chain, 
 						ra,
 						ssa, ssa_opcodes, op_array, op_array_ssa);
@@ -2876,41 +2878,36 @@ static zend_jit_reg_var* zend_jit_trace_allocate_registers(zend_jit_trace_rec *t
 							RA_IVAL_FLAGS(ssa_op->op1_use) |= ZREG_LAST_USE;
 						}
 					}
-				} else {
-					RA_IVAL_DEL(ssa_op->op1_use);
-					count--;
 				}
 			}
 			if (ssa_op->op2_use >= 0
 			 && ssa_op->op2_use != ssa_op->op1_use
-			 && RA_HAS_IVAL(ssa_op->op2_use)
-			 && !zend_ssa_is_no_val_use(opline, ssa_op, ssa_op->op2_use)) {
+			 && RA_HAS_IVAL(ssa_op->op2_use)) {
 				/* Quick workaround to disable register allocation for unsupported operand */
 				// TODO: Find a general solution ???
-				if (support_opline && opline->opcode != ZEND_FETCH_DIM_R) {
+				if (!support_opline || opline->opcode == ZEND_FETCH_DIM_R) {
+					RA_IVAL_DEL(ssa_op->op2_use);
+					count--;
+				} else if (!zend_ssa_is_no_val_use(opline, ssa_op, ssa_op->op2_use)) {
 					zend_jit_trace_use_var(idx, ssa_op->op2_use, ssa_op->op2_def, ssa_op->op2_use_chain,
 						ra,
 						ssa, ssa_opcodes, op_array, op_array_ssa);
 					if (opline->op2_type != IS_CV) {
 						RA_IVAL_FLAGS(ssa_op->op2_use) |= ZREG_LAST_USE;
 					}
-				} else {
-					RA_IVAL_DEL(ssa_op->op2_use);
-					count--;
 				}
 			}
 			if (ssa_op->result_use >= 0
 			 && ssa_op->result_use != ssa_op->op1_use
 			 && ssa_op->result_use != ssa_op->op2_use
-			 && RA_HAS_IVAL(ssa_op->result_use)
-			 && !zend_ssa_is_no_val_use(opline, ssa_op, ssa_op->result_use)) {
-				if (support_opline) {
+			 && RA_HAS_IVAL(ssa_op->result_use)) {
+				if (!support_opline) {
+					RA_IVAL_DEL(ssa_op->result_use);
+					count--;
+				} else if (!zend_ssa_is_no_val_use(opline, ssa_op, ssa_op->result_use)) {
 					zend_jit_trace_use_var(idx, ssa_op->result_use, ssa_op->result_def, ssa_op->res_use_chain,
 						ra,
 						ssa, ssa_opcodes, op_array, op_array_ssa);
-				} else {
-					RA_IVAL_DEL(ssa_op->result_use);
-					count--;
 				}
 			}
 

ext/opcache/tests/jit/gh12585.phpt

@@ -0,0 +1,30 @@
+--TEST--
+GH-12585: Assertion t->stack_map[t->exit_info[exit_point].stack_offset + var].type == 4
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit_hot_func=1
+opcache.jit_hot_loop=1
+opcache.jit_hot_return=1
+opcache.jit_hot_side_exit=1
+opcache.jit=1152
+--FILE--
+<?php
+class MyDatePeriod extends DatePeriod
+{
+    public function __construct(
+        DateTimeInterface $start,
+        DateInterval $interval,
+        int $recurrences,
+        int $options = 0,
+        public ?bool $myProperty = null,
+    ) {
+        parent::__construct($start, $interval, $recurrences, $options);
+    }
+}
+
+$d = new MyDatePeriod(new DateTimeImmutable(), new DateInterval("PT5S"), 5, myProperty: true);
+?>
+DONE
+--EXPECT--
+DONE