Non-JIT passes a pointer to a temp zval into zend_observer_fcall_end

segrax · segrax · commit bc2780251677 · 2024-09-15T15:31:31.000+10:00
diff --git a/ext/opcache/jit/zend_jit_arm64.dasc b/ext/opcache/jit/zend_jit_arm64.dasc
@@ -10943,6 +10943,7 @@ static int zend_jit_return(dasm_State **Dst, const zend_op *opline, const zend_o
 		if (Z_REFCOUNTED_P(zv)) {
 			|	ADDREF_CONST zv, REG0, TMP1
 		}
+		op1_addr = ret_addr;
 	} else if (opline->op1_type == IS_TMP_VAR) {
 		|	ZVAL_COPY_VALUE ret_addr, MAY_BE_ANY, op1_addr, op1_info, ZREG_REG0, ZREG_REG2, ZREG_TMP1, ZREG_TMP2, ZREG_FPR0
 	} else if (opline->op1_type == IS_CV) {
diff --git a/ext/opcache/jit/zend_jit_x86.dasc b/ext/opcache/jit/zend_jit_x86.dasc
@@ -11656,6 +11656,7 @@ static int zend_jit_return(dasm_State **Dst, const zend_op *opline, const zend_o
 		if (Z_REFCOUNTED_P(zv)) {
 			|	ADDREF_CONST zv, r0
 		}
+		op1_addr = ret_addr;
 	} else if (opline->op1_type == IS_TMP_VAR) {
 		|	ZVAL_COPY_VALUE ret_addr, MAY_BE_ANY, op1_addr, op1_info, ZREG_R0, ZREG_R2
 	} else if (opline->op1_type == IS_CV) {

Original file line number	Diff line number	Diff line change
`@@ -10943,6 +10943,7 @@ static int zend_jit_return(dasm_State *Dst, const zend_op opline, const zend_o`
`10943`	`10943`	`if (Z_REFCOUNTED_P(zv)) {`
`10944`	`10944`	`\| ADDREF_CONST zv, REG0, TMP1`
`10945`	`10945`	`}`
	`10946`	`+ op1_addr = ret_addr;`
`10946`	`10947`	`} else if (opline->op1_type == IS_TMP_VAR) {`
`10947`	`10948`	`\| ZVAL_COPY_VALUE ret_addr, MAY_BE_ANY, op1_addr, op1_info, ZREG_REG0, ZREG_REG2, ZREG_TMP1, ZREG_TMP2, ZREG_FPR0`
`10948`	`10949`	`} else if (opline->op1_type == IS_CV) {`
Original file line number	Diff line number	Diff line change
`@@ -11656,6 +11656,7 @@ static int zend_jit_return(dasm_State *Dst, const zend_op opline, const zend_o`
`11656`	`11656`	`if (Z_REFCOUNTED_P(zv)) {`
`11657`	`11657`	`\| ADDREF_CONST zv, r0`
`11658`	`11658`	`}`
	`11659`	`+ op1_addr = ret_addr;`
`11659`	`11660`	`} else if (opline->op1_type == IS_TMP_VAR) {`
`11660`	`11661`	`\| ZVAL_COPY_VALUE ret_addr, MAY_BE_ANY, op1_addr, op1_info, ZREG_R0, ZREG_R2`
`11661`	`11662`	`} else if (opline->op1_type == IS_CV) {`