Fixed bug #81409 (Incorrect JIT code for ADD with a reference to array)

dstogov · dstogov · commit cbc925e510fd · 2021-09-02T11:13:27.000+03:00
diff --git a/NEWS b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.1.0RC2
 
+- Opcache:
+  . Fixed bug #81409 (Incorrect JIT code for ADD with a reference to array).
+    (Dmitry)
+
 - Zip:
   . Fixed bug #80833 (ZipArchive::getStream doesn't use setPassword). (Remi)
 
diff --git a/ext/opcache/jit/zend_jit.c b/ext/opcache/jit/zend_jit.c
@@ -2989,7 +2989,7 @@ static int zend_jit(const zend_op_array *op_array, zend_ssa *ssa, const zend_op
 						if (opline->opcode == ZEND_ADD &&
 						    (op1_info & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_ARRAY &&
 						    (op2_info & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_ARRAY) {
-							if (!zend_jit_add_arrays(&dasm_state, opline, op1_info, op2_info, res_addr)) {
+							if (!zend_jit_add_arrays(&dasm_state, opline, op1_info, OP1_REG_ADDR(), op2_info, OP2_REG_ADDR(), res_addr)) {
 								goto jit_failure;
 							}
 						} else {
diff --git a/ext/opcache/jit/zend_jit_arm64.dasc b/ext/opcache/jit/zend_jit_arm64.dasc
@@ -4454,11 +4454,8 @@ static int zend_jit_math(dasm_State **Dst, const zend_op *opline, uint32_t op1_i
 	return 1;
 }
 
-static int zend_jit_add_arrays(dasm_State **Dst, const zend_op *opline, uint32_t op1_info, uint32_t op2_info, zend_jit_addr res_addr)
+static int zend_jit_add_arrays(dasm_State **Dst, const zend_op *opline, uint32_t op1_info, zend_jit_addr op1_addr, uint32_t op2_info, zend_jit_addr op2_addr, zend_jit_addr res_addr)
 {
-	zend_jit_addr op1_addr = OP1_ADDR();
-	zend_jit_addr op2_addr = OP2_ADDR();
-
 	|	GET_ZVAL_LVAL ZREG_FCARG1, op1_addr, TMP1
 	|	GET_ZVAL_LVAL ZREG_FCARG2, op2_addr, TMP1
 	|	EXT_CALL zend_jit_add_arrays_helper, REG0
diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c
@@ -4270,7 +4270,7 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
 						if (opline->opcode == ZEND_ADD &&
 						    (op1_info & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_ARRAY &&
 						    (op2_info & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_ARRAY) {
-							if (!zend_jit_add_arrays(&dasm_state, opline, op1_info, op2_info, res_addr)) {
+							if (!zend_jit_add_arrays(&dasm_state, opline, op1_info, op1_addr, op2_info, op2_addr, res_addr)) {
 								goto jit_failure;
 							}
 						} else {
diff --git a/ext/opcache/jit/zend_jit_x86.dasc b/ext/opcache/jit/zend_jit_x86.dasc
@@ -4877,11 +4877,8 @@ static int zend_jit_math(dasm_State **Dst, const zend_op *opline, uint32_t op1_i
 	return 1;
 }
 
-static int zend_jit_add_arrays(dasm_State **Dst, const zend_op *opline, uint32_t op1_info, uint32_t op2_info, zend_jit_addr res_addr)
+static int zend_jit_add_arrays(dasm_State **Dst, const zend_op *opline, uint32_t op1_info, zend_jit_addr op1_addr, uint32_t op2_info, zend_jit_addr op2_addr, zend_jit_addr res_addr)
 {
-	zend_jit_addr op1_addr = OP1_ADDR();
-	zend_jit_addr op2_addr = OP2_ADDR();
-
 	|	GET_ZVAL_LVAL ZREG_FCARG1, op1_addr
 	|	GET_ZVAL_LVAL ZREG_FCARG2, op2_addr
 	|	EXT_CALL zend_jit_add_arrays_helper, r0
diff --git a/ext/opcache/tests/jit/bug81409.phpt b/ext/opcache/tests/jit/bug81409.phpt
@@ -0,0 +1,26 @@
+--TEST--
+Bug #81409: Incorrect JIT code for ADD with a reference to array
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit_buffer_size=1M
+opcache.jit=tracing
+--FILE--
+<?php
+function foo(&$a) {
+    $n = count($a);	
+    $a = $a + [$n=>1];
+}
+function bar() {
+    $x = [];
+    for ($i = 0; $i < 200; $i++) {
+        foo($x);
+    }
+    var_dump(count($x));
+}
+bar();
+?>
+--EXPECT--
+int(200)

Original file line number	Diff line number	Diff line change
`@@ -2989,7 +2989,7 @@ static int zend_jit(const zend_op_array op_array, zend_ssa ssa, const zend_op`
`2989`	`2989`	`if (opline->opcode == ZEND_ADD &&`
`2990`	`2990`	`(op1_info & (MAY_BE_ANY\|MAY_BE_UNDEF)) == MAY_BE_ARRAY &&`
`2991`	`2991`	`(op2_info & (MAY_BE_ANY\|MAY_BE_UNDEF)) == MAY_BE_ARRAY) {`
`2992`		`- if (!zend_jit_add_arrays(&dasm_state, opline, op1_info, op2_info, res_addr)) {`
	`2992`	`+ if (!zend_jit_add_arrays(&dasm_state, opline, op1_info, OP1_REG_ADDR(), op2_info, OP2_REG_ADDR(), res_addr)) {`
`2993`	`2993`	`goto jit_failure;`
`2994`	`2994`	`}`
`2995`	`2995`	`} else {`
Original file line number	Diff line number	Diff line change
`@@ -4454,11 +4454,8 @@ static int zend_jit_math(dasm_State *Dst, const zend_op opline, uint32_t op1_i`
`4454`	`4454`	`return 1;`
`4455`	`4455`	`}`
`4456`	`4456`
`4457`		`-static int zend_jit_add_arrays(dasm_State *Dst, const zend_op opline, uint32_t op1_info, uint32_t op2_info, zend_jit_addr res_addr)`
	`4457`	`+static int zend_jit_add_arrays(dasm_State *Dst, const zend_op opline, uint32_t op1_info, zend_jit_addr op1_addr, uint32_t op2_info, zend_jit_addr op2_addr, zend_jit_addr res_addr)`
`4458`	`4458`	`{`
`4459`		`- zend_jit_addr op1_addr = OP1_ADDR();`
`4460`		`- zend_jit_addr op2_addr = OP2_ADDR();`
`4461`		`-`
`4462`	`4459`	`\| GET_ZVAL_LVAL ZREG_FCARG1, op1_addr, TMP1`
`4463`	`4460`	`\| GET_ZVAL_LVAL ZREG_FCARG2, op2_addr, TMP1`
`4464`	`4461`	`\| EXT_CALL zend_jit_add_arrays_helper, REG0`
Original file line number	Diff line number	Diff line change
`@@ -4270,7 +4270,7 @@ static const void zend_jit_trace(zend_jit_trace_rec trace_buffer, uint32_t par`
`4270`	`4270`	`if (opline->opcode == ZEND_ADD &&`
`4271`	`4271`	`(op1_info & (MAY_BE_ANY\|MAY_BE_UNDEF)) == MAY_BE_ARRAY &&`
`4272`	`4272`	`(op2_info & (MAY_BE_ANY\|MAY_BE_UNDEF)) == MAY_BE_ARRAY) {`
`4273`		`- if (!zend_jit_add_arrays(&dasm_state, opline, op1_info, op2_info, res_addr)) {`
	`4273`	`+ if (!zend_jit_add_arrays(&dasm_state, opline, op1_info, op1_addr, op2_info, op2_addr, res_addr)) {`
`4274`	`4274`	`goto jit_failure;`
`4275`	`4275`	`}`
`4276`	`4276`	`} else {`
Original file line number	Diff line number	Diff line change
`@@ -4877,11 +4877,8 @@ static int zend_jit_math(dasm_State *Dst, const zend_op opline, uint32_t op1_i`
`4877`	`4877`	`return 1;`
`4878`	`4878`	`}`
`4879`	`4879`
`4880`		`-static int zend_jit_add_arrays(dasm_State *Dst, const zend_op opline, uint32_t op1_info, uint32_t op2_info, zend_jit_addr res_addr)`
	`4880`	`+static int zend_jit_add_arrays(dasm_State *Dst, const zend_op opline, uint32_t op1_info, zend_jit_addr op1_addr, uint32_t op2_info, zend_jit_addr op2_addr, zend_jit_addr res_addr)`
`4881`	`4881`	`{`
`4882`		`- zend_jit_addr op1_addr = OP1_ADDR();`
`4883`		`- zend_jit_addr op2_addr = OP2_ADDR();`
`4884`		`-`
`4885`	`4882`	`\| GET_ZVAL_LVAL ZREG_FCARG1, op1_addr`
`4886`	`4883`	`\| GET_ZVAL_LVAL ZREG_FCARG2, op2_addr`
`4887`	`4884`	`\| EXT_CALL zend_jit_add_arrays_helper, r0`