From: Xinchen Hui <laruence@gmail.com>
Date: Mon, 29 Jun 2020 09:47:21 +0000 (+0800)
Subject: Fixed bug #79743 (Fatal error when assigning to array property with JIT enabled)
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d005a8e92becb9993ab0d370e4f5688d09bcaaf2;p=php

Fixed bug #79743 (Fatal error when assigning to array property with JIT enabled)

simple typo
---

diff --git a/NEWS b/NEWS
index be5aae762a..edaf30af76 100644
--- a/NEWS
+++ b/NEWS
@@ -72,6 +72,8 @@ PHP                                                                        NEWS
   . Removed deprecated INTL_IDNA_VARIANT_2003. (cmb)
 
 - JIT:
+  . Fixed bug #79743 (Fatal error when assigning to array property
+    with JIT enabled). (Laruence)
   . Fixed bug #79582 (Crash seen when opcache.jit=1235 and
     opcache.jit_debug=2). (Laruence)
   . Fixed bug #77857 (Wrong result if executed with JIT). (Laruence)
diff --git a/ext/opcache/jit/zend_jit_helpers.c b/ext/opcache/jit/zend_jit_helpers.c
index 17e5127240..3d40e745d1 100644
--- a/ext/opcache/jit/zend_jit_helpers.c
+++ b/ext/opcache/jit/zend_jit_helpers.c
@@ -1536,10 +1536,10 @@ static void ZEND_FASTCALL zend_jit_check_array_promotion(zval *val, zend_propert
 	const zend_op *opline = execute_data->opline;
 	zval *result = EX_VAR(opline->result.var);
 
-	if (((Z_TYPE_P(val) <= IS_FALSE
-	  || (Z_ISREF_P(val) && Z_TYPE_P(Z_REFVAL_P(val)) <= IS_FALSE))
-	 &&	ZEND_TYPE_IS_SET(prop->type)
-	 && ZEND_TYPE_FULL_MASK(prop->type) & (MAY_BE_ITERABLE|MAY_BE_ARRAY)) == 0) {
+	if ((Z_TYPE_P(val) <= IS_FALSE
+		|| (Z_ISREF_P(val) && Z_TYPE_P(Z_REFVAL_P(val)) <= IS_FALSE))
+		&& ZEND_TYPE_IS_SET(prop->type)
+		&& (ZEND_TYPE_FULL_MASK(prop->type) & (MAY_BE_ITERABLE|MAY_BE_ARRAY)) == 0) {
 		zend_string *type_str = zend_type_to_string(prop->type);
 		zend_type_error(
 			"Cannot auto-initialize an array inside property %s::$%s of type %s",