Skip to content

Commit a30d809

Browse files
committed
Fixed incorrect dead edge elimination during IR construction
Fixes oss-fuzz #63931
1 parent fa59bbe commit a30d809

File tree

2 files changed

+23
-1
lines changed

2 files changed

+23
-1
lines changed

ext/opcache/jit/zend_jit_ir.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3540,11 +3540,14 @@ static void _zend_jit_fix_merges(zend_jit_ctx *jit)
35403540
phi->op = IR_COPY;
35413541
phi->op1 = phi->op2;
35423542
phi->op2 = 1;
3543+
phi->inputs_count = 0;
3544+
} else {
3545+
phi->inputs_count = k + 1;
35433546
}
35443547
n2 = 1 + ((n + 1) >> 2);
35453548
k2 = 1 + ((k + 1) >> 2);
35463549
while (k2 != n2) {
3547-
(insn+k2)->optx = IR_NOP;
3550+
(phi+k2)->optx = IR_NOP;
35483551
k2++;
35493552
}
35503553
phi += 1 + ((n + 1) >> 2);

ext/opcache/tests/jit/loop_003.phpt

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
--TEST--
2+
JIT LOOP: 003 Incorrect dead IR edge elimination
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.jit_buffer_size=32M
7+
--FILE--
8+
<?php
9+
function () {
10+
$a = 0;
11+
while (y) {
12+
$a &= $y & $y;
13+
if (y) die &("");
14+
}
15+
};
16+
?>
17+
DONE
18+
--EXPECT--
19+
DONE

0 commit comments

Comments
 (0)