Skip to content

Commit 32f9db9

Browse files
lazerglazerg
authored
Fix GH-24154: Function JIT ++/-- on typed property holding a reference (#24155)
1 parent 51069ad commit 32f9db9

2 files changed

Lines changed: 43 additions & 2 deletions

File tree

‎ext/opcache/jit/zend_jit_helpers.c‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2991,7 +2991,8 @@ static void ZEND_FASTCALL zend_jit_inc_typed_prop(zval *var_ptr, zend_property_i
29912991
zend_execute_data *execute_data = EG(current_execute_data);
29922992
zval tmp;
29932993

2994-
ZVAL_COPY_DEREF(&tmp, var_ptr);
2994+
ZVAL_DEREF(var_ptr);
2995+
ZVAL_COPY(&tmp, var_ptr);
29952996

29962997
increment_function(var_ptr);
29972998

@@ -3022,7 +3023,8 @@ static void ZEND_FASTCALL zend_jit_dec_typed_prop(zval *var_ptr, zend_property_i
30223023
zend_execute_data *execute_data = EG(current_execute_data);
30233024
zval tmp;
30243025

3025-
ZVAL_COPY_DEREF(&tmp, var_ptr);
3026+
ZVAL_DEREF(var_ptr);
3027+
ZVAL_COPY(&tmp, var_ptr);
30263028

30273029
decrement_function(var_ptr);
30283030

‎ext/opcache/tests/jit/gh24154.phpt‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
--TEST--
2+
GH-24154 (Function JIT: ++/-- on a typed property holding a reference throws TypeError)
3+
--INI--
4+
opcache.enable=1
5+
opcache.enable_cli=1
6+
opcache.file_update_protection=0
7+
opcache.jit_buffer_size=64M
8+
opcache.jit=function
9+
--EXTENSIONS--
10+
opcache
11+
--FILE--
12+
<?php
13+
class Test
14+
{
15+
public int $value = 0;
16+
17+
public function inc(): void
18+
{
19+
$this->value++;
20+
}
21+
22+
public function dec(): void
23+
{
24+
$this->value--;
25+
}
26+
}
27+
28+
$test = new Test();
29+
$ref = &$test->value;
30+
$test->inc();
31+
var_dump($test->value);
32+
$test->dec();
33+
$test->dec();
34+
var_dump($test->value, $ref);
35+
?>
36+
--EXPECT--
37+
int(1)
38+
int(-1)
39+
int(-1)

0 commit comments

Comments
 (0)