Tracing JIT: Fixed FETCH_DIM_R with packed array and negative key

php · Sep 21, 2021 · 4d4a175 · 4d4a175
1 parent a86ed2d
commit 4d4a175
Show file tree

Hide file tree

Showing 3 changed files with 42 additions and 2 deletions.
diff --git a/ext/opcache/jit/zend_jit_arm64.dasc b/ext/opcache/jit/zend_jit_arm64.dasc
@@ -5058,7 +5058,7 @@ static int zend_jit_fetch_dimension_address_inner(dasm_State **Dst, const zend_o
 						|	b >2 // NOT_FOUND
 					}
 				}
-				if (op1_info & MAY_BE_ARRAY_NUMERIC_HASH) {
+				if (!packed_loaded || (op1_info & MAY_BE_ARRAY_NUMERIC_HASH)) {
 					|4:
 					if (!op2_loaded) {
 						|	// hval = Z_LVAL_P(dim);

diff --git a/ext/opcache/jit/zend_jit_x86.dasc b/ext/opcache/jit/zend_jit_x86.dasc
@@ -5536,7 +5536,7 @@ static int zend_jit_fetch_dimension_address_inner(dasm_State **Dst, const zend_o
 						|	jmp >2 // NOT_FOUND
 					}
 				}
-				if (op1_info & MAY_BE_ARRAY_NUMERIC_HASH) {
+				if (!packed_loaded || (op1_info & MAY_BE_ARRAY_NUMERIC_HASH)) {
 					|4:
 					if (!op2_loaded) {
 						|	// hval = Z_LVAL_P(dim);

diff --git a/ext/opcache/tests/jit/fetch_dim_r_005.phpt b/ext/opcache/tests/jit/fetch_dim_r_005.phpt
@@ -0,0 +1,40 @@
+--TEST--
+JIT FETCH_DIM_R: 005
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+opcache.jit=tracing
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+$gens = [];
+for ($i = 0; $i < 5; $i++) {
+    $gens[] = $gens[-1];
+}
+var_dump($gens);
+?>
+--EXPECTF--
+Warning: Undefined array key -1 in %sfetch_dim_r_005.php on line 4
+
+Warning: Undefined array key -1 in %sfetch_dim_r_005.php on line 4
+
+Warning: Undefined array key -1 in %sfetch_dim_r_005.php on line 4
+
+Warning: Undefined array key -1 in %sfetch_dim_r_005.php on line 4
+
+Warning: Undefined array key -1 in %sfetch_dim_r_005.php on line 4
+array(5) {
+  [0]=>
+  NULL
+  [1]=>
+  NULL
+  [2]=>
+  NULL
+  [3]=>
+  NULL
+  [4]=>
+  NULL
+}