Skip to content

Assertion failure in JIT trace exit with ZEND_FETCH_DIM_FUNC_ARG #17140

Description

@YuanchengJiang

Description

The following code:

<?php
namespace Foo;
function test() {
$a['x'][1] = true;
for ($fusion = 0; $i < 3; $i++) {
var_dump($a['x'][0]);
}
}
test();

Resulted in this output:

php: ext/opcache/jit/zend_jit_trace.c:8657: int zend_jit_trace_exit(uint32_t, zend_jit_registers_buf *): Assertion `op->opcode == ZEND_FETCH_DIM_R || op->opcode == ZEND_FETCH_LIST_R || op->opcode == ZEND_FETCH_OBJ_R' failed.
Aborted (core dumped)

To reproduce:

-d "opcache.jit_hot_func=1" -d "opcache.jit_hot_side_exit=1" -d "zend_extension=/home/phpfuzz/WorkSpace/flowfusion/php-src/modules/opcache.so" -d "opcache.enable_cli=1" -d "opcache.jit=1254"

PHP Version

nightly

Operating System

ubuntu 22.04

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions