Repository navigation
Conversation
_zend_jit_fix_merges() compacts the non-zero inputs of a MERGE or LOOP_BEGIN to the left but left the vacated slots holding their old refs. When a single input survives, the node becomes a BEGIN whose op2 is a label operand, so the stale END ref was read as a label: ir_save() asserted on it, and the aliasing load and store searches stopped at the block as if its address were taken. PHI inputs are compacted the same way but are bounded by inputs_count, and a PHI reduced to COPY already overwrites op2. Fixes phpGH-24397
Owner
Author
|
Submitted upstream as php#24419. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
_zend_jit_fix_merges()compacts a MERGE's live inputs to the left without clearing the slots it vacates. When one input survives, the node becomes a BEGIN whose op2 is a label operand, so the stale END ref is read as a label:ir_save()asserts on it in debug builds when an IR dump bit is set inopcache.jit_debug, and in all builds the aliasing load and store searches treat the block as address-taken and stop there.The test fails only on debug builds, since
IR_ASSERTis compiled out in release. PHI compaction in the same function reads only up to inputs_count, and the PHI-to-COPY conversion already overwrites op2.Fixes php#24397