Skip to content

Commit 7f68a7a

Browse files
dstogovdstogov
committed
Fixed bug #80745 (JIT produces Assert failure and UNKNOWN:0 var_dumps in code involving bitshifts)
1 parent 408272b commit 7f68a7a

4 files changed

Lines changed: 102 additions & 12 deletions

File tree

‎NEWS‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ PHP NEWS
2828
. Fixed bug #80682 (opcache doesn't honour pcre.jit option). (Remi)
2929
. Fixed bug #80742 (Opcache JIT makes some boolean logic unexpectedly be
3030
true). (Dmitry)
31+
. Fixed bug #80745 (JIT produces Assert failure and UNKNOWN:0 var_dumps in
32+
code involving bitshifts). (Dmitry)
3133

3234
- OpenSSL:
3335
. Fixed bug #80747 (Providing RSA key size < 512 generates key that crash

‎ext/opcache/jit/zend_jit.c‎

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2303,7 +2303,17 @@ static int zend_jit(const zend_op_array *op_array, zend_ssa *ssa, const zend_op
23032303
break;
23042304
}
23052305
if (opline->result_type != IS_UNUSED) {
2306-
res_use_info = RES_USE_INFO();
2306+
res_use_info = -1;
2307+
2308+
if (opline->result_type == IS_CV) {
2309+
zend_jit_addr res_use_addr = RES_USE_REG_ADDR();
2310+
2311+
if (Z_MODE(res_use_addr) != IS_REG
2312+
|| Z_LOAD(res_use_addr)
2313+
|| Z_STORE(res_use_addr)) {
2314+
res_use_info = RES_USE_INFO();
2315+
}
2316+
}
23072317
res_info = RES_INFO();
23082318
res_addr = RES_REG_ADDR();
23092319
} else {
@@ -2354,7 +2364,17 @@ static int zend_jit(const zend_op_array *op_array, zend_ssa *ssa, const zend_op
23542364
goto jit_failure;
23552365
}
23562366
} else {
2357-
res_use_info = RES_USE_INFO();
2367+
res_use_info = -1;
2368+
2369+
if (opline->result_type == IS_CV) {
2370+
zend_jit_addr res_use_addr = RES_USE_REG_ADDR();
2371+
2372+
if (Z_MODE(res_use_addr) != IS_REG
2373+
|| Z_LOAD(res_use_addr)
2374+
|| Z_STORE(res_use_addr)) {
2375+
res_use_info = RES_USE_INFO();
2376+
}
2377+
}
23582378
}
23592379
if (!zend_jit_long_math(&dasm_state, opline,
23602380
op1_info, OP1_RANGE(), OP1_REG_ADDR(),
@@ -2398,7 +2418,17 @@ static int zend_jit(const zend_op_array *op_array, zend_ssa *ssa, const zend_op
23982418
goto jit_failure;
23992419
}
24002420
} else {
2401-
res_use_info = RES_USE_INFO();
2421+
res_use_info = -1;
2422+
2423+
if (opline->result_type == IS_CV) {
2424+
zend_jit_addr res_use_addr = RES_USE_REG_ADDR();
2425+
2426+
if (Z_MODE(res_use_addr) != IS_REG
2427+
|| Z_LOAD(res_use_addr)
2428+
|| Z_STORE(res_use_addr)) {
2429+
res_use_info = RES_USE_INFO();
2430+
}
2431+
}
24022432
}
24032433
res_info = RES_INFO();
24042434
if (opline->opcode == ZEND_ADD &&

‎ext/opcache/jit/zend_jit_trace.c‎

Lines changed: 24 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3878,10 +3878,15 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
38783878
STACK_MEM_TYPE(stack, EX_VAR_TO_NUM(opline->result.var)))
38793879
& (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE);
38803880
#else
3881+
res_use_info = -1;
38813882
if (opline->result_type == IS_CV) {
3882-
res_use_info = RES_USE_INFO();
3883-
} else {
3884-
res_use_info = MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE;
3883+
zend_jit_addr res_use_addr = RES_USE_REG_ADDR();
3884+
3885+
if (Z_MODE(res_use_addr) != IS_REG
3886+
|| Z_LOAD(res_use_addr)
3887+
|| Z_STORE(res_use_addr)) {
3888+
res_use_info = RES_USE_INFO();
3889+
}
38853890
}
38863891
#endif
38873892
res_info = RES_INFO();
@@ -3973,10 +3978,15 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
39733978
STACK_MEM_TYPE(stack, EX_VAR_TO_NUM(opline->result.var)))
39743979
& (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE);
39753980
#else
3981+
res_use_info = -1;
39763982
if (opline->result_type == IS_CV) {
3977-
res_use_info = RES_USE_INFO();
3978-
} else {
3979-
res_use_info = MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE;
3983+
zend_jit_addr res_use_addr = RES_USE_REG_ADDR();
3984+
3985+
if (Z_MODE(res_use_addr) != IS_REG
3986+
|| Z_LOAD(res_use_addr)
3987+
|| Z_STORE(res_use_addr)) {
3988+
res_use_info = RES_USE_INFO();
3989+
}
39803990
}
39813991
#endif
39823992
}
@@ -4050,10 +4060,15 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
40504060
STACK_MEM_TYPE(stack, EX_VAR_TO_NUM(opline->result.var)))
40514061
& (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE);
40524062
#else
4063+
res_use_info = -1;
40534064
if (opline->result_type == IS_CV) {
4054-
res_use_info = RES_USE_INFO();
4055-
} else {
4056-
res_use_info = MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE;
4065+
zend_jit_addr res_use_addr = RES_USE_REG_ADDR();
4066+
4067+
if (Z_MODE(res_use_addr) != IS_REG
4068+
|| Z_LOAD(res_use_addr)
4069+
|| Z_STORE(res_use_addr)) {
4070+
res_use_info = RES_USE_INFO();
4071+
}
40574072
}
40584073
#endif
40594074
}

‎ext/opcache/tests/jit/bug80745.phpt‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
--TEST--
2+
Bug #80745 (JIT produces Assert failure and UNKNOWN:0 var_dumps in code involving bitshifts)
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.file_update_protection=0
7+
opcache.jit=function
8+
opcache.jit_buffer_size=1M
9+
opcache.protect_memory=1
10+
--SKIPIF--
11+
<?php require_once('skipif.inc'); ?>
12+
--FILE--
13+
<?php
14+
15+
final class Message
16+
{
17+
public $qr = false;
18+
19+
public $opcode = 0;
20+
21+
public $aa = false;
22+
}
23+
24+
echo "Starting...\n";
25+
26+
function headerToBinary(Message $message)
27+
{
28+
$flags = 0;
29+
$flags = ($flags << 1) | ($message->qr ? 1 : 0);
30+
$flags = ($flags << 4) | $message->opcode;
31+
var_dump($flags);
32+
$flags = ($flags << 1) | ($message->aa ? 1 : 0);
33+
}
34+
35+
headerToBinary(new Message());
36+
37+
echo "PROBLEM NOT REPRODUCED !\n";
38+
?>
39+
--EXPECT--
40+
Starting...
41+
int(0)
42+
PROBLEM NOT REPRODUCED !
43+

0 commit comments

Comments
 (0)