archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.0'

Browse source 
* PHP-8.0:
  Fixed bug #81051 (Broken property type handling after incrementing reference)
This commit is contained in:
Dmitry Stogov 2021-05-27 15:23:20 +03:00
commit a50a1b643e
2 changed files with 50 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
ext/opcache/jit/zend_jit_helpers.c
View file

@ -2116,6 +2116,7 @@ static void ZEND_FASTCALL zend_jit_assign_op_to_typed_prop(zval *zptr, zend_prop
zend_execute_data *execute_data = EG(current_execute_data); zend_execute_data *execute_data = EG(current_execute_data);
zval z_copy; zval z_copy;
ZVAL_DEREF(zptr);
binary_op(&z_copy, zptr, value); binary_op(&z_copy, zptr, value);
if (EXPECTED(zend_verify_property_type(prop_info, &z_copy, EX_USES_STRICT_TYPES()))) { if (EXPECTED(zend_verify_property_type(prop_info, &z_copy, EX_USES_STRICT_TYPES()))) {
zval_ptr_dtor(zptr); zval_ptr_dtor(zptr);
@ -2198,6 +2199,7 @@ static void ZEND_FASTCALL zend_jit_inc_typed_prop(zval *var_ptr, zend_property_i
zend_execute_data *execute_data = EG(current_execute_data); zend_execute_data *execute_data = EG(current_execute_data);
zval tmp; zval tmp;
ZVAL_DEREF(var_ptr);
ZVAL_COPY(&tmp, var_ptr); ZVAL_COPY(&tmp, var_ptr);
increment_function(var_ptr); increment_function(var_ptr);
@ -2220,6 +2222,7 @@ static void ZEND_FASTCALL zend_jit_dec_typed_prop(zval *var_ptr, zend_property_i
zend_execute_data *execute_data = EG(current_execute_data); zend_execute_data *execute_data = EG(current_execute_data);
zval tmp; zval tmp;
ZVAL_DEREF(var_ptr);
ZVAL_COPY(&tmp, var_ptr); ZVAL_COPY(&tmp, var_ptr);
decrement_function(var_ptr); decrement_function(var_ptr);
@ -2246,6 +2249,7 @@ static void ZEND_FASTCALL zend_jit_pre_inc_typed_prop(zval *var_ptr, zend_proper
result = &tmp; result = &tmp;
} }
ZVAL_DEREF(var_ptr);
ZVAL_COPY(result, var_ptr); ZVAL_COPY(result, var_ptr);
increment_function(var_ptr); increment_function(var_ptr);
@ -2276,6 +2280,7 @@ static void ZEND_FASTCALL zend_jit_pre_dec_typed_prop(zval *var_ptr, zend_proper
result = &tmp; result = &tmp;
} }
ZVAL_DEREF(var_ptr);
ZVAL_COPY(result, var_ptr); ZVAL_COPY(result, var_ptr);
decrement_function(var_ptr); decrement_function(var_ptr);
@ -2301,6 +2306,7 @@ static void ZEND_FASTCALL zend_jit_post_inc_typed_prop(zval *var_ptr, zend_prope
{ {
zend_execute_data *execute_data = EG(current_execute_data); zend_execute_data *execute_data = EG(current_execute_data);
ZVAL_DEREF(var_ptr);
ZVAL_COPY(result, var_ptr); ZVAL_COPY(result, var_ptr);
increment_function(var_ptr); increment_function(var_ptr);
@ -2321,6 +2327,7 @@ static void ZEND_FASTCALL zend_jit_post_dec_typed_prop(zval *var_ptr, zend_prope
{ {
zend_execute_data *execute_data = EG(current_execute_data); zend_execute_data *execute_data = EG(current_execute_data);
ZVAL_DEREF(var_ptr);
ZVAL_COPY(result, var_ptr); ZVAL_COPY(result, var_ptr);
decrement_function(var_ptr); decrement_function(var_ptr);

43
ext/opcache/tests/jit/bug81051.phpt Normal file
View file

@ -0,0 +1,43 @@
--TEST--
Bug #80839: PHP problem with JIT
--INI--
opcache.enable=1
opcache.enable_cli=1
opcache.jit_buffer_size=1M
opcache.jit=1205
--SKIPIF--
<?php require_once('skipif.inc'); ?>
--FILE--
<?php
class Binary{
public static function readUnsignedVarInt(string $buffer, int &$offset) : int{
$offset++;
return 0;
}
}
class BinaryStream{
private string $buffer;
private int $offset;
public function __construct(string $buffer, int $offset = 0){
$this->buffer = $buffer;
$this->offset = $offset;
}
public function getUnsignedVarInt() : int{
return Binary::readUnsignedVarInt($this->buffer, $this->offset);
}
public function get(int $len) : string{
return $len === 1 ? $this->buffer[$this->offset++] : substr($this->buffer, ($this->offset += $len) - $len, $len);
}
}
$stream = new BinaryStream(str_repeat("\x01a", 1000));
var_dump($stream->getUnsignedVarInt());
var_dump($stream->get(1));
?>
--EXPECT--
int(0)
string(1) "a"