Skip to content

ext/opcache: tracing JIT drops reference type of a named by-ref argum… - #25377

Closed
devnexen wants to merge 2 commits into
php:PHP-8.4from
devnexen:gh25359
Closed

devnexen wants to merge 2 commits into
php:PHP-8.4from
devnexen:gh25359

Conversation

@devnexen

Copy link
Copy Markdown
Member

…ent.

Fix GH-25359

zend_jit_trace_build_tssa() narrowed SEND_VAR_EX op1_def to the by-value type using op2.num, which is the name literal for a named argument. The callee looked by-value, so the CV lost MAY_BE_REF and the ref leaked or was returned unwrapped. Skip the narrowing for named arguments.

…ent.

Fix phpGH-25359

zend_jit_trace_build_tssa() narrowed SEND_VAR_EX op1_def to the by-value
type using op2.num, which is the name literal for a named argument. The
callee looked by-value, so the CV lost MAY_BE_REF and the ref leaked or
was returned unwrapped. Skip the narrowing for named arguments.
@iliaal

iliaal commented Nov 10, 2026

Copy link
Copy Markdown
Member

Fix looks right. gh25359.phpt passes unpatched for me on NTS and ZTS debug builds (with ZEND_VERIFY_TYPE_INFERENCE too). Does it need ASAN to fail? gh25359_2.phpt does pin it.

@iliaal iliaal left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for making the fixes, g2g now

@devnexen devnexen closed this in cde751d Nov 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Tracing JIT: Assertion in _get_zval_ptr_tmp: TMP holds a reference after by-ref named-argument call (incomplete fix of GH-21972)

2 participants