Skip to content

JIT: Fix SWITCH_STRING type checks on referenced operand - #24796

Closed
jorgsowa wants to merge 1 commit into
php:PHP-8.4from
jorgsowa:fix-jit-switch-string-ref
Closed

jorgsowa wants to merge 1 commit into
php:PHP-8.4from
jorgsowa:fix-jit-switch-string-ref

Conversation

@jorgsowa

@jorgsowa jorgsowa commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor

The tracing guard checked IS_LONG instead of IS_STRING after ZVAL_DEREF, passing a non-string to zend_hash_find(). The function JIT path checked IS_STRING instead of IS_REFERENCE, so the deref fast path was dead.

The test switch_003.phpt doesn't fail before patch, because it was effectively dead code before. It's added for the proper test coverage.

@jorgsowa jorgsowa self-assigned this Oct 27, 2026
@jorgsowa
jorgsowa requested a review from dstogov as a code owner October 27, 2026 17:44
The tracing guard checked IS_LONG instead of IS_STRING after ZVAL_DEREF,
passing a non-string to zend_hash_find(). The function JIT path checked
IS_STRING instead of IS_REFERENCE, so the deref fast path was dead.
@jorgsowa
jorgsowa force-pushed the fix-jit-switch-string-ref branch from 43b8a6b to a04a71e Compare October 27, 2026 17:51

@iliaal iliaal left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good fix, plz resolve NEWS conflict so ci/cd can run

@ndossche ndossche left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Interesting, so one crash fix and one fix so the fast path can be taken now

@jorgsowa jorgsowa closed this in ef873f6 Oct 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants