From 3f50922aeef3b96cfa528e96e907a2094507e81b Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@zend.com>
Date: Mon, 14 Oct 2019 16:45:58 +0300
Subject: [PATCH] Fixed incorrect JIT compilation

---
 ext/opcache/jit/zend_jit_x86.dasc       |  9 ++++++---
 ext/opcache/tests/jit/send_val_001.phpt | 23 +++++++++++++++++++++++
 2 files changed, 29 insertions(+), 3 deletions(-)
 create mode 100644 ext/opcache/tests/jit/send_val_001.phpt

diff --git a/ext/opcache/jit/zend_jit_x86.dasc b/ext/opcache/jit/zend_jit_x86.dasc
index ba3d4b36fe..f8ebc9321f 100644
--- a/ext/opcache/jit/zend_jit_x86.dasc
+++ b/ext/opcache/jit/zend_jit_x86.dasc
@@ -3505,7 +3505,8 @@ static int zend_jit_math(dasm_State **Dst, const zend_op *opline, int *opnum, ze
 	if (opline->result_type == IS_TMP_VAR &&
 	    (opline+1)->opcode == ZEND_SEND_VAL &&
 	    (opline+1)->op1_type == IS_TMP_VAR &&
-	    (opline+1)->op1.var == opline->result.var) {
+	    (opline+1)->op1.var == opline->result.var &&
+	    ssa->cfg.map[(opline+1) - op_array->opcodes] == ssa->cfg.map[opline - op_array->opcodes]) {
 		/* Eliminate the following SEND_VAL */
 		(*opnum)++;
 		if (!reuse_ip) {
@@ -3839,7 +3840,8 @@ static int zend_jit_long_math(dasm_State **Dst, const zend_op *opline, int *opnu
 	if (opline->result_type == IS_TMP_VAR &&
 	    (opline+1)->opcode == ZEND_SEND_VAL &&
 	    (opline+1)->op1_type == IS_TMP_VAR &&
-	    (opline+1)->op1.var == opline->result.var) {
+	    (opline+1)->op1.var == opline->result.var &&
+	    ssa->cfg.map[(opline+1) - op_array->opcodes] == ssa->cfg.map[opline - op_array->opcodes]) {
 		/* Eliminate the following SEND_VAL */
 		(*opnum)++;
 		if (!reuse_ip) {
@@ -3980,7 +3982,8 @@ static int zend_jit_concat(dasm_State **Dst, const zend_op *opline, int *opnum,
 	if (opline->result_type == IS_TMP_VAR &&
 	    (opline+1)->opcode == ZEND_SEND_VAL &&
 	    (opline+1)->op1_type == IS_TMP_VAR &&
-	    (opline+1)->op1.var == opline->result.var) {
+	    (opline+1)->op1.var == opline->result.var &&
+	    ssa->cfg.map[(opline+1) - op_array->opcodes] == ssa->cfg.map[opline - op_array->opcodes]) {
 		/* Eliminate the following SEND_VAL */
 		(*opnum)++;
 		if (!reuse_ip) {
diff --git a/ext/opcache/tests/jit/send_val_001.phpt b/ext/opcache/tests/jit/send_val_001.phpt
new file mode 100644
index 0000000000..1293df7dec
--- /dev/null
+++ b/ext/opcache/tests/jit/send_val_001.phpt
@@ -0,0 +1,23 @@
+--TEST--
+JIT SEND_VAL: 001
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+function foo($type) {
+        $key = md5(
+            is_array($type) ? \implode('_', $type) : $type .
+            "ops"
+        );
+		return $key;
+}
+var_dump(foo("int"));
+var_dump(foo(["int"]));
+--EXPECT--
+string(32) "253a948ecc9192cb47e492f692aa63a8"
+string(32) "fa7153f7ed1cb6c0fcf2ffb2fac21748"
-- 
2.50.1