Repository navigation
Conversation
_zend_jit_fix_merges() compacts the non-zero inputs of a MERGE or LOOP_BEGIN to the left but left the vacated slots holding their old refs. When a single input survives, the node becomes a BEGIN whose op2 is a label operand, so the stale END ref was read as a label: ir_save() asserted on it, and the aliasing load and store searches stopped at the block as if its address were taken. PHI inputs are compacted the same way but are bounded by inputs_count, and a PHI reduced to COPY already overwrites op2. Fixes phpGH-24397
Girgias
requested changes
Oct 18, 2026
Girgias
left a comment
Member
There was a problem hiding this comment.
Could you fix the thing you've been asked to fix on Slack before submitting more PRs?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
_zend_jit_fix_merges()compacts a MERGE's live inputs to the left without clearing the slots it vacates. When one input survives, the node becomes a BEGIN whose op2 is a label operand, so the stale END ref is read as a label:ir_save()asserts on it in debug builds whenopcache.jit_debugsets an IR dump bit, and in all builds the aliasing load and store searches treat the block as address-taken and stop there. PHI compaction reads only up to inputs_count, and the PHI-to-COPY conversion already overwrites op2.Fixes #24397