Skip to content

Commit d17c672

Browse files
dstogovdstogov
committed
Merge branch 'PHP-8.3'
* PHP-8.3: Fixed GH-12382: JIT Index invalid or out of range error
2 parents 57a8f63 + 9e1e1bc commit d17c672

File tree

2 files changed

+76
-7
lines changed

2 files changed

+76
-7
lines changed

‎ext/opcache/jit/zend_jit_x86.dasc

Lines changed: 37 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4408,6 +4408,7 @@ static int zend_jit_math_long_long(dasm_State **Dst,
44084408
uint32_t res_use_info,
44094409
int may_overflow)
44104410
{
4411+
bool must_set_cflags = 0;
44114412
bool same_ops = zend_jit_same_addr(op1_addr, op2_addr);
44124413
zend_reg result_reg;
44134414
zend_reg tmp_reg = ZREG_R0;
@@ -4430,34 +4431,63 @@ static int zend_jit_math_long_long(dasm_State **Dst,
44304431
tmp_reg = ZREG_FCARG1;
44314432
}
44324433

4434+
if (may_overflow) {
4435+
must_set_cflags = 1;
4436+
} else {
4437+
const zend_op *next_opline = opline + 1;
4438+
4439+
if (next_opline->opcode == ZEND_IS_EQUAL ||
4440+
next_opline->opcode == ZEND_IS_NOT_EQUAL ||
4441+
next_opline->opcode == ZEND_IS_SMALLER ||
4442+
next_opline->opcode == ZEND_IS_SMALLER_OR_EQUAL ||
4443+
next_opline->opcode == ZEND_CASE ||
4444+
next_opline->opcode == ZEND_IS_IDENTICAL ||
4445+
next_opline->opcode == ZEND_IS_NOT_IDENTICAL ||
4446+
next_opline->opcode == ZEND_CASE_STRICT) {
4447+
if (next_opline->op1_type == IS_CONST
4448+
&& Z_TYPE_P(RT_CONSTANT(next_opline, next_opline->op1)) == IS_LONG
4449+
&& Z_LVAL_P(RT_CONSTANT(next_opline, next_opline->op1)) == 0
4450+
&& next_opline->op2_type == opline->result_type
4451+
&& next_opline->op2.var == opline->result.var) {
4452+
must_set_cflags = 1;
4453+
} else if (next_opline->op2_type == IS_CONST
4454+
&& Z_TYPE_P(RT_CONSTANT(next_opline, next_opline->op2)) == IS_LONG
4455+
&& Z_LVAL_P(RT_CONSTANT(next_opline, next_opline->op2)) == 0
4456+
&& next_opline->op2_type == opline->result_type
4457+
&& next_opline->op2.var == opline->result.var) {
4458+
must_set_cflags = 1;
4459+
}
4460+
}
4461+
}
4462+
44334463
if (opcode == ZEND_MUL &&
44344464
Z_MODE(op2_addr) == IS_CONST_ZVAL &&
44354465
Z_LVAL_P(Z_ZV(op2_addr)) == 2) {
4436-
if (Z_MODE(op1_addr) == IS_REG && !may_overflow) {
4466+
if (Z_MODE(op1_addr) == IS_REG && !must_set_cflags) {
44374467
| lea Ra(result_reg), [Ra(Z_REG(op1_addr))+Ra(Z_REG(op1_addr))]
44384468
} else {
44394469
| GET_ZVAL_LVAL result_reg, op1_addr
44404470
| add Ra(result_reg), Ra(result_reg)
44414471
}
44424472
} else if (opcode == ZEND_MUL &&
44434473
Z_MODE(op2_addr) == IS_CONST_ZVAL &&
4444-
!may_overflow &&
4474+
!must_set_cflags &&
44454475
Z_LVAL_P(Z_ZV(op2_addr)) > 0 &&
44464476
zend_long_is_power_of_two(Z_LVAL_P(Z_ZV(op2_addr)))) {
44474477
| GET_ZVAL_LVAL result_reg, op1_addr
44484478
| shl Ra(result_reg), zend_long_floor_log2(Z_LVAL_P(Z_ZV(op2_addr)))
44494479
} else if (opcode == ZEND_MUL &&
44504480
Z_MODE(op1_addr) == IS_CONST_ZVAL &&
44514481
Z_LVAL_P(Z_ZV(op1_addr)) == 2) {
4452-
if (Z_MODE(op2_addr) == IS_REG && !may_overflow) {
4482+
if (Z_MODE(op2_addr) == IS_REG && !must_set_cflags) {
44534483
| lea Ra(result_reg), [Ra(Z_REG(op2_addr))+Ra(Z_REG(op2_addr))]
44544484
} else {
44554485
| GET_ZVAL_LVAL result_reg, op2_addr
44564486
| add Ra(result_reg), Ra(result_reg)
44574487
}
44584488
} else if (opcode == ZEND_MUL &&
44594489
Z_MODE(op1_addr) == IS_CONST_ZVAL &&
4460-
!may_overflow &&
4490+
!must_set_cflags &&
44614491
Z_LVAL_P(Z_ZV(op1_addr)) > 0 &&
44624492
zend_long_is_power_of_two(Z_LVAL_P(Z_ZV(op1_addr)))) {
44634493
| GET_ZVAL_LVAL result_reg, op2_addr
@@ -4468,19 +4498,19 @@ static int zend_jit_math_long_long(dasm_State **Dst,
44684498
| GET_ZVAL_LVAL result_reg, op1_addr
44694499
| shr Ra(result_reg), zend_long_floor_log2(Z_LVAL_P(Z_ZV(op2_addr)))
44704500
} else if (opcode == ZEND_ADD &&
4471-
!may_overflow &&
4501+
!must_set_cflags &&
44724502
Z_MODE(op1_addr) == IS_REG &&
44734503
Z_MODE(op2_addr) == IS_CONST_ZVAL &&
44744504
IS_SIGNED_32BIT(Z_LVAL_P(Z_ZV(op2_addr)))) {
44754505
| lea Ra(result_reg), [Ra(Z_REG(op1_addr))+Z_LVAL_P(Z_ZV(op2_addr))]
44764506
} else if (opcode == ZEND_ADD &&
4477-
!may_overflow &&
4507+
!must_set_cflags &&
44784508
Z_MODE(op2_addr) == IS_REG &&
44794509
Z_MODE(op1_addr) == IS_CONST_ZVAL &&
44804510
IS_SIGNED_32BIT(Z_LVAL_P(Z_ZV(op1_addr)))) {
44814511
| lea Ra(result_reg), [Ra(Z_REG(op2_addr))+Z_LVAL_P(Z_ZV(op1_addr))]
44824512
} else if (opcode == ZEND_SUB &&
4483-
!may_overflow &&
4513+
!must_set_cflags &&
44844514
Z_MODE(op1_addr) == IS_REG &&
44854515
Z_MODE(op2_addr) == IS_CONST_ZVAL &&
44864516
IS_SIGNED_32BIT(-Z_LVAL_P(Z_ZV(op2_addr)))) {

‎ext/opcache/tests/jit/gh12382.phpt

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
--TEST--
2+
GH-12382: JIT Index invalid or out of range error
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
--FILE--
7+
<?php
8+
function applyMaskPenaltyRule3(SplFixedArray $array) : void
9+
{
10+
for ($y = 0; $y < 21; ++$y) {
11+
for ($x = 0; $x < 21; ++$x) {
12+
if (
13+
(
14+
$x + 10 < 21
15+
&& 0 === $array[$y][$x + 7]
16+
)
17+
|| (
18+
$x - 4 >= 0
19+
&& 0 === $array[$y][$x - 1]
20+
)
21+
) {
22+
}
23+
}
24+
}
25+
}
26+
27+
$matrix = SplFixedArray::fromArray(
28+
array_map(
29+
fn (array $arr): SplFixedArray => SplFixedArray::fromArray($arr),
30+
[[1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 0, 1, 1, 0, 1, 1, 1, 1, 1, 1, 1, ], [1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 0, 0, 1, ], [1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, ], [1, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, 0, 1, ], [1, 0, 1, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 0, 1, ], [1, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 1, ], [1, 1, 1, 1, 1, 1, 1, 0, 1, 0, 1, 0, 1, 0, 1, 1, 1, 1, 1, 1, 1, ], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ], [0, 0, 1, 0, 1, 1, 1, 0, 1, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 1, ], [0, 0, 1, 1, 0, 0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0, ], [0, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 0, 0, 1, 0, 0, 0, 1, ], [1, 0, 0, 1, 0, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, ], [1, 1, 0, 0, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 0, 1, 0, 1, 0, 1, ], [0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 1, 1, ], [1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 1, 0, 0, 1, 1, 1, 0, 1, 1, 1, 1, ], [1, 0, 0, 0, 0, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 0, 0, 0, ], [1, 0, 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1, 0, 1, ], [1, 0, 1, 1, 1, 0, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 0, ], [1, 0, 1, 1, 1, 0, 1, 0, 1, 0, 1, 1, 0, 1, 0, 0, 1, 0, 0, 0, 1, ], [1, 0, 0, 0, 0, 0, 1, 0, 0, 0, 1, 0, 1, 1, 1, 0, 0, 0, 1, 1, 0, ], [1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 1, 1, 1, 0, 1, 0, 1, 1, 1, ], ]
31+
)
32+
);
33+
34+
applyMaskPenaltyRule3($matrix);
35+
applyMaskPenaltyRule3($matrix);
36+
?>
37+
DONE
38+
--EXPECT--
39+
DONE

0 commit comments

Comments
 (0)