Fixed codegeneration for FETCH_DIM_IS

Fixes oss-fuzz #63666
php · Oct 30, 2023 · e482785 · e482785
1 parent c8cb68a
commit e482785
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 0 deletions.
diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c
@@ -12095,6 +12095,10 @@ static int zend_jit_fetch_dim_read(zend_jit_ctx       *jit,
 				jit_ZVAL_COPY(jit, res_addr, -1, val_addr, res_info, 1);
 			}
 
+			ir_END_list(end_inputs);
+		} else if (not_found_inputs) {
+			ir_MERGE_list(not_found_inputs);
+			jit_set_Z_TYPE_INFO(jit, res_addr, IS_NULL);
 			ir_END_list(end_inputs);
 		}
 	}

diff --git a/ext/opcache/tests/jit/fetch_dim_is_001.phpt b/ext/opcache/tests/jit/fetch_dim_is_001.phpt
@@ -0,0 +1,16 @@
+--TEST--
+JIT FETCH_DIM_IS: 001
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+--FILE--
+<?php
+const A = [1];
+A[-1][2]??$y;
+?>
+DONE
+--EXPECTF--
+Warning: Undefined variable $y in %sfetch_dim_is_001.php on line 3
+DONE