Skip to content

ext/opcache: tracing JIT drops reference type of a named by-ref argum… - #25377

Open
devnexen wants to merge 2 commits into
php:PHP-8.4from
devnexen:gh25359
Open

devnexen wants to merge 2 commits into
php:PHP-8.4from
devnexen:gh25359

Conversation

@devnexen

Copy link
Copy Markdown
Member

…ent.

Fix GH-25359

zend_jit_trace_build_tssa() narrowed SEND_VAR_EX op1_def to the by-value type using op2.num, which is the name literal for a named argument. The callee looked by-value, so the CV lost MAY_BE_REF and the ref leaked or was returned unwrapped. Skip the narrowing for named arguments.

…ent.

Fix phpGH-25359

zend_jit_trace_build_tssa() narrowed SEND_VAR_EX op1_def to the by-value
type using op2.num, which is the name literal for a named argument. The
callee looked by-value, so the CV lost MAY_BE_REF and the ref leaked or
was returned unwrapped. Skip the narrowing for named arguments.
@iliaal

iliaal commented Nov 10, 2026

Copy link
Copy Markdown
Member

Fix looks right. gh25359.phpt passes unpatched for me on NTS and ZTS debug builds (with ZEND_VERIFY_TYPE_INFERENCE too). Does it need ASAN to fail? gh25359_2.phpt does pin it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Tracing JIT: Assertion in _get_zval_ptr_tmp: TMP holds a reference after by-ref named-argument call (incomplete fix of GH-21972)

2 participants