diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c index f8503a131734..ae9088878b62 100644 --- a/ext/opcache/jit/zend_jit_ir.c +++ b/ext/opcache/jit/zend_jit_ir.c @@ -859,12 +859,14 @@ void *zend_jit_snapshot_handler(ir_ctx *ctx, ir_ref snapshot_ref, ir_insn *snaps t->stack_map[t->exit_info[exit_point].stack_offset + var].flags = ZREG_TYPE_ONLY; } else { if ((exit_flags & ZEND_JIT_EXIT_FIXED) - && t->stack_map[t->exit_info[exit_point].stack_offset + var].reg != IR_REG_NUM(reg)) { + && (t->stack_map[t->exit_info[exit_point].stack_offset + var].reg != IR_REG_NUM(reg) + || (t->stack_map[t->exit_info[exit_point].stack_offset + var].flags & ~(ZREG_LOAD|ZREG_STORE|ZREG_LAST_USE)))) { exit_point = zend_jit_duplicate_exit_point(ctx, t, exit_point, snapshot_ref); addr = (void*)zend_jit_trace_get_exit_addr(exit_point); exit_flags &= ~ZEND_JIT_EXIT_FIXED; } t->stack_map[t->exit_info[exit_point].stack_offset + var].reg = IR_REG_NUM(reg); + t->stack_map[t->exit_info[exit_point].stack_offset + var].flags &= (ZREG_LOAD|ZREG_STORE|ZREG_LAST_USE); } } else { if ((exit_flags & ZEND_JIT_EXIT_FIXED) diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c index 5cc3dbd3aa0b..c8ef22c88069 100644 --- a/ext/opcache/jit/zend_jit_trace.c +++ b/ext/opcache/jit/zend_jit_trace.c @@ -3558,6 +3558,8 @@ static int zend_jit_trace_deoptimization( } } } else if (STACK_FLAGS(parent_stack, i) == ZREG_TYPE_ONLY) { + ZEND_ASSERT(reg == ZREG_NONE); + uint8_t type = STACK_TYPE(parent_stack, i); if (!zend_jit_store_type(jit, i, type)) { diff --git a/ext/opcache/tests/jit/gh22763.phpt b/ext/opcache/tests/jit/gh22763.phpt new file mode 100644 index 000000000000..67d7caa308ed --- /dev/null +++ b/ext/opcache/tests/jit/gh22763.phpt @@ -0,0 +1,58 @@ +--TEST-- +GH-22763: JIT fails to clear ZREG_TYPE_ONLY after setting reg +--FILE-- += -$d && $kf <= $d && $vf[$offset + $kf] + $vb[$offset + $k] >= $n) { + return [$n - $x, $m - $y, $n - $xs, $m - $ys]; + } + } + } + + return []; +} + +$from = [3,2,1]; +$to = [1,99,3]; +findMiddleSnake($from, 0, count($from), $to, 0, count($to)); +?> +--EXPECTF-- +int(0) + +Warning: Undefined array key 3 in %s on line %d