Skip to content

Commit 6c3816c

Browse files
committed
Tracing JIT: Eliminate useless guards for CONCAT
Fixes oss-fuzz #45285
1 parent 151d2ac commit 6c3816c

File tree

2 files changed

+46
-2
lines changed

2 files changed

+46
-2
lines changed

ext/opcache/jit/zend_jit_trace.c

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1612,6 +1612,14 @@ static zend_ssa *zend_jit_trace_build_tssa(zend_jit_trace_rec *trace_buffer, uin
16121612
}
16131613
ADD_OP1_TRACE_GUARD();
16141614
break;
1615+
case ZEND_CONCAT:
1616+
case ZEND_FAST_CONCAT:
1617+
if ((opline->op1_type == IS_CONST || orig_op1_type == IS_STRING)
1618+
&& (opline->op2_type == IS_CONST || orig_op2_type == IS_STRING)) {
1619+
ADD_OP2_TRACE_GUARD();
1620+
ADD_OP1_TRACE_GUARD();
1621+
}
1622+
break;
16151623
case ZEND_IS_EQUAL:
16161624
case ZEND_IS_NOT_EQUAL:
16171625
case ZEND_IS_SMALLER:
@@ -1630,8 +1638,6 @@ static zend_ssa *zend_jit_trace_build_tssa(zend_jit_trace_rec *trace_buffer, uin
16301638
case ZEND_SUB:
16311639
case ZEND_MUL:
16321640
// case ZEND_DIV: // TODO: check for division by zero ???
1633-
case ZEND_CONCAT:
1634-
case ZEND_FAST_CONCAT:
16351641
ADD_OP2_TRACE_GUARD();
16361642
/* break missing intentionally */
16371643
case ZEND_ECHO:
Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
--TEST--
2+
JIT FETCH_DIM_R: 012
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.file_update_protection=0
7+
opcache.jit_buffer_size=1M
8+
--FILE--
9+
<?php
10+
function foo() {
11+
$a = 0; $a1 = []; $a2 = [];
12+
for($i = 0; $i < 6; $i++) {
13+
$a1[] = &$y;
14+
$a2["$a1[$a] "] = $a += $y;
15+
}
16+
var_dump($a1, $a2);
17+
}
18+
foo();
19+
?>
20+
--EXPECT--
21+
array(6) {
22+
[0]=>
23+
&NULL
24+
[1]=>
25+
&NULL
26+
[2]=>
27+
&NULL
28+
[3]=>
29+
&NULL
30+
[4]=>
31+
&NULL
32+
[5]=>
33+
&NULL
34+
}
35+
array(1) {
36+
[" "]=>
37+
int(0)
38+
}

0 commit comments

Comments
 (0)