From: Dmitry Stogov <dmitry@zend.com>
Date: Wed, 17 Mar 2021 13:55:09 +0000 (+0300)
Subject: Fixed bug #80839 (PHP problem with JIT)
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=faf1567212bb83e39bf113149bf31abf719ca3a5;p=php

Fixed bug #80839 (PHP problem with JIT)
---

diff --git a/NEWS b/NEWS
index 0da6240423..ac6b906aba 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,9 @@ PHP                                                                        NEWS
   . Fixed bug #80847 (CData structs with fields of type struct can't be passed
     as C function argument). (Nickolas Daniel da Silva, Dmitry)
 
+- Opcache:
+  . Fixed bug #80839 (PHP problem with JIT). (Dmitry)
+
 01 Apr 2021, PHP 8.0.4
 
 - Core:
diff --git a/ext/opcache/jit/zend_jit_x86.dasc b/ext/opcache/jit/zend_jit_x86.dasc
index 41a0d2fe07..04243cf34a 100644
--- a/ext/opcache/jit/zend_jit_x86.dasc
+++ b/ext/opcache/jit/zend_jit_x86.dasc
@@ -5221,6 +5221,9 @@ static int zend_jit_concat_helper(dasm_State    **Dst,
 			|	add r4, 12
 			|.endif
 		}
+		/* concatination with empty string may increase refcount */
+		op1_info |= MAY_BE_RCN;
+		op2_info |= MAY_BE_RCN;
 		|	FREE_OP op1_type, op1, op1_info, 0, opline
 		|	FREE_OP op2_type, op2, op2_info, 0, opline
 		|5:
@@ -5247,6 +5250,9 @@ static int zend_jit_concat_helper(dasm_State    **Dst,
 		|.if not(X64)
 		|	add r4, 12
 		|.endif
+		/* concatination with empty string may increase refcount */
+		op1_info |= MAY_BE_RCN;
+		op2_info |= MAY_BE_RCN;
 		|	FREE_OP op1_type, op1, op1_info, 0, opline
 		|	FREE_OP op2_type, op2, op2_info, 0, opline
 		if (may_throw) {
diff --git a/ext/opcache/tests/jit/bug80839.phpt b/ext/opcache/tests/jit/bug80839.phpt
new file mode 100644
index 0000000000..efa697ecdc
--- /dev/null
+++ b/ext/opcache/tests/jit/bug80839.phpt
@@ -0,0 +1,37 @@
+--TEST--
+Bug #80839: PHP problem with JIT
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit_buffer_size=1M
+opcache.jit=function
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+$a = null; // the problem only occurs when set to NULL
+test($a, 'y');
+
+function test($str, $pad) {
+	$x = $str . str_repeat($pad, 15); // $x now contains "yyyyyyyyyyyyyyy"
+	var_dump($x);
+
+	$gft = new gft();
+	$gft->info(33);
+
+	// $x has been changed ????
+	// $x contains what was echoed in the function 'info'
+	var_dump($x);
+}
+class gft {
+	private $strVal = 'abcd ';
+	public function info($info, $prefix = ' Info:') {
+		echo $this->strVal.$prefix.serialize($info).'aaaa';
+		echo "\n";
+	}
+}
+?>
+--EXPECT--
+string(15) "yyyyyyyyyyyyyyy"
+abcd  Info:i:33;aaaa
+string(15) "yyyyyyyyyyyyyyy"