Commit 25348e809d4 for php
commit 25348e809d4e2ec89c6de562d22c876e4ab90a1d
Author: lazerg <lazerg2@gmail.com>
Date: Thu Oct 15 10:18:18 2026 +0500
Fix GH-24337: JIT segfault when decrementing a non-numeric string property
Closes GH-24342.
diff --git a/NEWS b/NEWS
index 531fb312e05..c695f56584c 100644
--- a/NEWS
+++ b/NEWS
@@ -60,6 +60,8 @@ PHP NEWS
. Fix OSS-Fuzz #568005340 (FETCH_DIM_FUNC_ARG partial conversion). (ndossche)
. Fixed bug GH-24218 (Invalid opcode for count() of a literal array when
SCCP is disabled). (Lazizbek Ergashev)
+ . Fixed bug GH-24337 (JIT: segfault when decrementing a non-numeric string
+ property). (Lazizbek Ergashev)
- PDO:
. Fixed a duplicate warning when ATTR_STATEMENT_CLASS is rejected on a
diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c
index 50851d75abb..92a068dbfac 100644
--- a/ext/opcache/jit/zend_jit_ir.c
+++ b/ext/opcache/jit/zend_jit_ir.c
@@ -15823,12 +15823,13 @@ static int zend_jit_incdec_obj(zend_jit_ctx *jit,
}
if (var_info & (MAY_BE_ANY - MAY_BE_LONG)) {
- if (var_info & (MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
- may_throw = 1;
- }
if (if_long) {
ir_IF_FALSE_cold(if_long);
}
+ if (var_info & (MAY_BE_ANY - (MAY_BE_LONG|MAY_BE_DOUBLE))) {
+ may_throw = 1;
+ jit_SET_EX_OPLINE(jit, opline);
+ }
if (opline->opcode == ZEND_POST_INC_OBJ || opline->opcode == ZEND_POST_DEC_OBJ) {
jit_ZVAL_COPY(jit, res_addr, -1, var_addr, var_info, 1);
}
diff --git a/ext/opcache/tests/jit/gh24337.phpt b/ext/opcache/tests/jit/gh24337.phpt
new file mode 100644
index 00000000000..3aad4d768e9
--- /dev/null
+++ b/ext/opcache/tests/jit/gh24337.phpt
@@ -0,0 +1,105 @@
+--TEST--
+GH-24337 (JIT: segfault in zend_get_executed_lineno when decrementing a non-numeric string property)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=64M
+opcache.jit=tracing
+opcache.jit_hot_loop=2
+opcache.jit_hot_func=2
+opcache.jit_hot_return=2
+opcache.jit_hot_side_exit=1
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+set_error_handler(function ($errno, $errstr, $errfile, $errline) {
+ echo "$errstr on line $errline\n";
+});
+class Q {
+ public $pu = 0;
+ function run() {
+ for ($i = 0; $i < 2; $i++) {
+ $this->pu--;
+ }
+ }
+ function inc() {
+ for ($i = 0; $i < 2; $i++) {
+ $this->pu++;
+ }
+ }
+}
+class S extends Q {
+ public $pu = 'u';
+ function run() {
+ parent::run();
+ }
+}
+class B extends Q {
+ public $pu = true;
+ function run() {
+ parent::run();
+ }
+}
+class A extends Q {
+ public $pu = [];
+ function run() {
+ parent::run();
+ }
+}
+$objs = [new Q, new S, new B, new A];
+for ($k = 0; $k < 4; $k++) {
+ foreach ($objs as $o) {
+ try {
+ $o->run();
+ } catch (TypeError $e) {
+ echo $e->getMessage(), " on line ", $e->getLine(), "\n";
+ }
+ try {
+ $o->inc();
+ } catch (TypeError $e) {
+ echo $e->getMessage(), " on line ", $e->getLine(), "\n";
+ }
+ }
+}
+var_dump($objs[0]->pu, $objs[1]->pu, $objs[2]->pu, $objs[3]->pu);
+?>
+--EXPECT--
+Decrement on non-numeric string has no effect and is deprecated on line 9
+Decrement on non-numeric string has no effect and is deprecated on line 9
+Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
+Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
+Increment on type bool has no effect, this will change in the next major version of PHP on line 14
+Increment on type bool has no effect, this will change in the next major version of PHP on line 14
+Cannot decrement array on line 9
+Cannot increment array on line 14
+Decrement on non-numeric string has no effect and is deprecated on line 9
+Decrement on non-numeric string has no effect and is deprecated on line 9
+Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
+Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
+Increment on type bool has no effect, this will change in the next major version of PHP on line 14
+Increment on type bool has no effect, this will change in the next major version of PHP on line 14
+Cannot decrement array on line 9
+Cannot increment array on line 14
+Decrement on non-numeric string has no effect and is deprecated on line 9
+Decrement on non-numeric string has no effect and is deprecated on line 9
+Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
+Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
+Increment on type bool has no effect, this will change in the next major version of PHP on line 14
+Increment on type bool has no effect, this will change in the next major version of PHP on line 14
+Cannot decrement array on line 9
+Cannot increment array on line 14
+Decrement on non-numeric string has no effect and is deprecated on line 9
+Decrement on non-numeric string has no effect and is deprecated on line 9
+Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
+Decrement on type bool has no effect, this will change in the next major version of PHP on line 9
+Increment on type bool has no effect, this will change in the next major version of PHP on line 14
+Increment on type bool has no effect, this will change in the next major version of PHP on line 14
+Cannot decrement array on line 9
+Cannot increment array on line 14
+int(0)
+string(2) "ac"
+bool(true)
+array(0) {
+}