JIT: Fixed incorrect reference handling in PRE_INC/DEC_OBJ

php · Oct 7, 2021 · 6ab36fb · 6ab36fb
1 parent cd45bd0
commit 6ab36fb
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 0 deletions.
diff --git a/ext/opcache/jit/zend_jit_helpers.c b/ext/opcache/jit/zend_jit_helpers.c
@@ -2367,12 +2367,14 @@ static void ZEND_FASTCALL zend_jit_dec_typed_prop(zval *var_ptr, zend_property_i
 
 static void ZEND_FASTCALL zend_jit_pre_inc_typed_prop(zval *var_ptr, zend_property_info *prop_info, zval *result)
 {
+	ZVAL_DEREF(var_ptr);
 	zend_jit_inc_typed_prop(var_ptr, prop_info);
 	ZVAL_COPY(result, var_ptr);
 }
 
 static void ZEND_FASTCALL zend_jit_pre_dec_typed_prop(zval *var_ptr, zend_property_info *prop_info, zval *result)
 {
+	ZVAL_DEREF(var_ptr);
 	zend_jit_dec_typed_prop(var_ptr, prop_info);
 	ZVAL_COPY(result, var_ptr);
 }

diff --git a/ext/opcache/tests/jit/inc_obj_003.phpt b/ext/opcache/tests/jit/inc_obj_003.phpt
@@ -0,0 +1,20 @@
+--TEST--
+PRE_INC_OBJ: 003
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+opcache.protect_memory=1
+--FILE--
+<?php
+class Test {
+    public float $prop = 1.0;
+}
+$test = new Test;
+$r = &$test->prop;
+$v = --$test->prop;
+var_dump($v);
+?>
+--EXPECT--
+float(0)