diff --git a/NEWS b/NEWS index aa752e0af386..f3ae9c3f8867 100644 --- a/NEWS +++ b/NEWS @@ -70,6 +70,8 @@ PHP NEWS SCCP is disabled). (Lazizbek Ergashev) . Fixed bug GH-24337 (JIT: segfault when decrementing a non-numeric string property). (Lazizbek Ergashev) + . Fixed bug GH-24388 (Tracing JIT: segfault when a trace runs out of side + exits). (Lazizbek Ergashev) - PDO: . Fixed a duplicate warning when ATTR_STATEMENT_CLASS is rejected on a diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c index 92a068dbfaca..f1c21976d933 100644 --- a/ext/opcache/jit/zend_jit_ir.c +++ b/ext/opcache/jit/zend_jit_ir.c @@ -4921,6 +4921,9 @@ static int zend_jit_inc_dec(zend_jit_ctx *jit, const zend_op *opline, uint32_t o exit_point = zend_jit_trace_get_exit_point(opline + 1, 0); exit_addr = zend_jit_trace_get_exit_addr(exit_point); + if (!exit_addr) { + return 0; + } ir_GUARD_NOT(ir_OVERFLOW(ref), ir_CONST_ADDR(exit_addr)); if ((opline->opcode == ZEND_PRE_INC || opline->opcode == ZEND_PRE_DEC) && @@ -4962,6 +4965,9 @@ static int zend_jit_inc_dec(zend_jit_ctx *jit, const zend_op *opline, uint32_t o exit_point = zend_jit_trace_get_exit_point(opline + 1, 0); exit_addr = zend_jit_trace_get_exit_addr(exit_point); + if (!exit_addr) { + return 0; + } ir_GUARD(ir_OVERFLOW(ref), ir_CONST_ADDR(exit_addr)); if (opline->result_type != IS_UNUSED) { diff --git a/ext/opcache/tests/jit/gh24388.phpt b/ext/opcache/tests/jit/gh24388.phpt new file mode 100644 index 000000000000..7a73bb7fb3cf --- /dev/null +++ b/ext/opcache/tests/jit/gh24388.phpt @@ -0,0 +1,31 @@ +--TEST-- +GH-24388 (Tracing JIT: segfault when a trace runs out of side exits) +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.file_update_protection=0 +opcache.jit_buffer_size=64M +opcache.jit=tracing +--EXTENSIONS-- +opcache +--FILE-- + +DONE +--CLEAN-- + +--EXPECT-- +DONE