diff --git a/ext/opcache/jit/zend_jit_helpers.c b/ext/opcache/jit/zend_jit_helpers.c index 73bd52cdaff..78b160a6173 100644 --- a/ext/opcache/jit/zend_jit_helpers.c +++ b/ext/opcache/jit/zend_jit_helpers.c @@ -2116,6 +2116,7 @@ static void ZEND_FASTCALL zend_jit_assign_op_to_typed_prop(zval *zptr, zend_prop zend_execute_data *execute_data = EG(current_execute_data); zval z_copy; + ZVAL_DEREF(zptr); binary_op(&z_copy, zptr, value); if (EXPECTED(zend_verify_property_type(prop_info, &z_copy, EX_USES_STRICT_TYPES()))) { zval_ptr_dtor(zptr); @@ -2198,6 +2199,7 @@ static void ZEND_FASTCALL zend_jit_inc_typed_prop(zval *var_ptr, zend_property_i zend_execute_data *execute_data = EG(current_execute_data); zval tmp; + ZVAL_DEREF(var_ptr); ZVAL_COPY(&tmp, var_ptr); increment_function(var_ptr); @@ -2220,6 +2222,7 @@ static void ZEND_FASTCALL zend_jit_dec_typed_prop(zval *var_ptr, zend_property_i zend_execute_data *execute_data = EG(current_execute_data); zval tmp; + ZVAL_DEREF(var_ptr); ZVAL_COPY(&tmp, var_ptr); decrement_function(var_ptr); @@ -2246,6 +2249,7 @@ static void ZEND_FASTCALL zend_jit_pre_inc_typed_prop(zval *var_ptr, zend_proper result = &tmp; } + ZVAL_DEREF(var_ptr); ZVAL_COPY(result, var_ptr); increment_function(var_ptr); @@ -2276,6 +2280,7 @@ static void ZEND_FASTCALL zend_jit_pre_dec_typed_prop(zval *var_ptr, zend_proper result = &tmp; } + ZVAL_DEREF(var_ptr); ZVAL_COPY(result, var_ptr); decrement_function(var_ptr); @@ -2301,6 +2306,7 @@ static void ZEND_FASTCALL zend_jit_post_inc_typed_prop(zval *var_ptr, zend_prope { zend_execute_data *execute_data = EG(current_execute_data); + ZVAL_DEREF(var_ptr); ZVAL_COPY(result, var_ptr); increment_function(var_ptr); @@ -2321,6 +2327,7 @@ static void ZEND_FASTCALL zend_jit_post_dec_typed_prop(zval *var_ptr, zend_prope { zend_execute_data *execute_data = EG(current_execute_data); + ZVAL_DEREF(var_ptr); ZVAL_COPY(result, var_ptr); decrement_function(var_ptr); diff --git a/ext/opcache/tests/jit/bug81051.phpt b/ext/opcache/tests/jit/bug81051.phpt new file mode 100644 index 00000000000..3ea3d019ace --- /dev/null +++ b/ext/opcache/tests/jit/bug81051.phpt @@ -0,0 +1,43 @@ +--TEST-- +Bug #80839: PHP problem with JIT +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.jit_buffer_size=1M +opcache.jit=1205 +--SKIPIF-- + +--FILE-- +buffer = $buffer; + $this->offset = $offset; + } + + public function getUnsignedVarInt() : int{ + return Binary::readUnsignedVarInt($this->buffer, $this->offset); + } + + public function get(int $len) : string{ + return $len === 1 ? $this->buffer[$this->offset++] : substr($this->buffer, ($this->offset += $len) - $len, $len); + } +} +$stream = new BinaryStream(str_repeat("\x01a", 1000)); +var_dump($stream->getUnsignedVarInt()); +var_dump($stream->get(1)); +?> +--EXPECT-- +int(0) +string(1) "a"