|
| 1 | +--TEST-- |
| 2 | +GH-22857: Function JIT emits wrong code for FETCH_OBJ_FUNC_ARG on a property hook (SIMPLE_GET fast path) |
| 3 | +--INI-- |
| 4 | +opcache.enable=1 |
| 5 | +opcache.enable_cli=1 |
| 6 | +opcache.jit_buffer_size=64M |
| 7 | +opcache.jit=1205 |
| 8 | +opcache.jit_hot_func=1 |
| 9 | +--EXTENSIONS-- |
| 10 | +opcache |
| 11 | +--FILE-- |
| 12 | +<?php |
| 13 | +namespace Test; |
| 14 | + |
| 15 | +interface HandlerInterface { public function noop(): void; } |
| 16 | + |
| 17 | +final class DefaultHandler implements HandlerInterface { |
| 18 | + private static ?self $i = null; |
| 19 | + public static function getInstance(): self { return self::$i ??= new self(); } |
| 20 | + public function noop(): void {} |
| 21 | +} |
| 22 | + |
| 23 | +/* Original issue: virtual property hook read via FETCH_OBJ_FUNC_ARG under |
| 24 | + * function JIT. The getter frame is pushed by the SIMPLE_GET fast path in the |
| 25 | + * shared FETCH_OBJ_R handler, but the JIT-compiled FUNC_ARG opcode had no |
| 26 | + * hook-enter guard, so the argument slot was read before the getter ran. |
| 27 | + * |
| 28 | + * The assertion is deterministic: the getter sets a static flag as a side |
| 29 | + * effect, so we check whether the getter actually ran when the property is |
| 30 | + * passed through FETCH_OBJ_FUNC_ARG. This avoids the previous data-dependent |
| 31 | + * failure mode (relying on file_get_contents() fataling on whatever garbage |
| 32 | + * the unguarded JIT read happened to land on), which made the regression |
| 33 | + * test flaky. */ |
| 34 | +class Container { |
| 35 | + private static bool $getterRan = false; |
| 36 | + |
| 37 | + public protected(set) HandlerInterface $handler; |
| 38 | + |
| 39 | + public string $path { |
| 40 | + get => (self::$getterRan = true) |
| 41 | + ? self::build($this->kind, $this->id) |
| 42 | + : self::build($this->kind, $this->id); |
| 43 | + } |
| 44 | + |
| 45 | + protected mixed $prev = null; |
| 46 | + |
| 47 | + public function __construct( |
| 48 | + public protected(set) string $kind, |
| 49 | + public protected(set) string $id, |
| 50 | + ) { |
| 51 | + $this->handler = DefaultHandler::getInstance(); |
| 52 | + } |
| 53 | + |
| 54 | + public static function build(string $k, string $i): string { |
| 55 | + return "/nonexistent/gh22857_{$k}_{$i}.dat"; |
| 56 | + } |
| 57 | + |
| 58 | + public function step(): void { |
| 59 | + /* Unqualified namespaced-fallback call (INIT_NS_FCALL_BY_NAME) keeps |
| 60 | + * the FETCH_OBJ_FUNC_ARG opcode instead of letting the optimizer |
| 61 | + * rewrite it to FETCH_OBJ_R. @ preserves the opcode shape that |
| 62 | + * triggers the bug. */ |
| 63 | + @file_get_contents($this->path); |
| 64 | + if (!self::$getterRan) { |
| 65 | + throw new \RuntimeException('getter did not run via FUNC_ARG'); |
| 66 | + } |
| 67 | + } |
| 68 | +} |
| 69 | + |
| 70 | +$c = new Container('alpha', 'beta'); |
| 71 | +$c->step(); |
| 72 | +$c->step(); |
| 73 | +$c->step(); |
| 74 | + |
| 75 | +/* Sibling-slot variant: a preceding plain FETCH_OBJ_R primes the |
| 76 | + * SIMPLE_GET bit on the property cache slot; compact_literals shares the |
| 77 | + * slot between FETCH_OBJ_R and FETCH_OBJ_FUNC_ARG for the same property, |
| 78 | + * so the following FETCH_OBJ_FUNC_ARG consumes that bit and hits the |
| 79 | + * SIMPLE_GET fast path. Without the hook-enter guard it passes whatever |
| 80 | + * sits in an adjacent property slot instead of running the getter. The |
| 81 | + * flag is reset after the priming FETCH_OBJ_R so the assertion reflects |
| 82 | + * only whether the getter ran during the FETCH_OBJ_FUNC_ARG read. */ |
| 83 | +class Container2 { |
| 84 | + private static bool $getterRan = false; |
| 85 | + |
| 86 | + public protected(set) HandlerInterface $handler; |
| 87 | + |
| 88 | + public string $path { |
| 89 | + get => (self::$getterRan = true) |
| 90 | + ? self::build($this->kind, $this->id) |
| 91 | + : self::build($this->kind, $this->id); |
| 92 | + } |
| 93 | + |
| 94 | + protected mixed $prev = null; |
| 95 | + |
| 96 | + public function __construct( |
| 97 | + public protected(set) string $kind, |
| 98 | + public protected(set) string $id, |
| 99 | + ) { |
| 100 | + $this->handler = DefaultHandler::getInstance(); |
| 101 | + } |
| 102 | + |
| 103 | + public static function build(string $k, string $i): string { |
| 104 | + return "/nonexistent/gh22857b_{$k}_{$i}.dat"; |
| 105 | + } |
| 106 | + |
| 107 | + public function step(): void { |
| 108 | + $this->prev = $this->path; // FETCH_OBJ_R primes SIMPLE_GET on shared slot |
| 109 | + self::$getterRan = false; // reset; flag now reflects only the FUNC_ARG read below |
| 110 | + @file_get_contents($this->path); // FETCH_OBJ_FUNC_ARG consumes the primed bit |
| 111 | + if (!self::$getterRan) { |
| 112 | + throw new \RuntimeException('sibling-slot variant: getter did not run via FUNC_ARG'); |
| 113 | + } |
| 114 | + } |
| 115 | +} |
| 116 | + |
| 117 | +$c2 = new Container2('alpha', 'beta'); |
| 118 | +$c2->step(); |
| 119 | +$c2->step(); |
| 120 | +$c2->step(); |
| 121 | + |
| 122 | +echo "OK\n"; |
| 123 | +?> |
| 124 | +--EXPECT-- |
| 125 | +OK |
0 commit comments