Fixed bug #80839 (PHP problem with JIT)

diff --git a/NEWS b/NEWS
index 0da6240423a786a5b86fb000c54e8ae68597dd24..ac6b906abaef8c1c1f0536f6bf848371d1f20fd6 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,9 @@ PHP                                                                        NEWS
   . Fixed bug #80847 (CData structs with fields of type struct can't be passed
     as C function argument). (Nickolas Daniel da Silva, Dmitry)
 
+- Opcache:
+  . Fixed bug #80839 (PHP problem with JIT). (Dmitry)
+
 01 Apr 2021, PHP 8.0.4
 
 - Core:

diff --git a/ext/opcache/jit/zend_jit_x86.dasc b/ext/opcache/jit/zend_jit_x86.dasc
index 41a0d2fe079e377ba3e7717abfb83a96ac2cd736..04243cf34a54274f93b65688b37ae34a42f3415e 100644 (file)
--- a/ext/opcache/jit/zend_jit_x86.dasc
+++ b/ext/opcache/jit/zend_jit_x86.dasc
@@ -5221,6 +5221,9 @@ static int zend_jit_concat_helper(dasm_State    **Dst,
                        |       add r4, 12
                        |.endif
                }
+               /* concatination with empty string may increase refcount */
+               op1_info |= MAY_BE_RCN;
+               op2_info |= MAY_BE_RCN;
                |       FREE_OP op1_type, op1, op1_info, 0, opline
                |       FREE_OP op2_type, op2, op2_info, 0, opline
                |5:
@@ -5247,6 +5250,9 @@ static int zend_jit_concat_helper(dasm_State    **Dst,
                |.if not(X64)
                |       add r4, 12
                |.endif
+               /* concatination with empty string may increase refcount */
+               op1_info |= MAY_BE_RCN;
+               op2_info |= MAY_BE_RCN;
                |       FREE_OP op1_type, op1, op1_info, 0, opline
                |       FREE_OP op2_type, op2, op2_info, 0, opline
                if (may_throw) {

diff --git a/ext/opcache/tests/jit/bug80839.phpt b/ext/opcache/tests/jit/bug80839.phpt
new file mode 100644 (file)
index 0000000..efa697e
--- /dev/null
+++ b/ext/opcache/tests/jit/bug80839.phpt
@@ -0,0 +1,37 @@
+--TEST--
+Bug #80839: PHP problem with JIT
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit_buffer_size=1M
+opcache.jit=function
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+$a = null; // the problem only occurs when set to NULL
+test($a, 'y');
+
+function test($str, $pad) {
+       $x = $str . str_repeat($pad, 15); // $x now contains "yyyyyyyyyyyyyyy"
+       var_dump($x);
+
+       $gft = new gft();
+       $gft->info(33);
+
+       // $x has been changed ????
+       // $x contains what was echoed in the function 'info'
+       var_dump($x);
+}
+class gft {
+       private $strVal = 'abcd ';
+       public function info($info, $prefix = ' Info:') {
+               echo $this->strVal.$prefix.serialize($info).'aaaa';
+               echo "\n";
+       }
+}
+?>
+--EXPECT--
+string(15) "yyyyyyyyyyyyyyy"
+abcd  Info:i:33;aaaa
+string(15) "yyyyyyyyyyyyyyy"