diff --git a/Zend/Optimizer/zend_inference.c b/Zend/Optimizer/zend_inference.c index 7169238893159..fc6b9b421b628 100644 --- a/Zend/Optimizer/zend_inference.c +++ b/Zend/Optimizer/zend_inference.c @@ -1968,6 +1968,10 @@ static uint32_t get_ssa_alias_types(zend_ssa_alias_kind alias) { /* TODO: support for array keys and ($str . "")*/ \ __type |= MAY_BE_RCN; \ } \ + if ((__type & MAY_BE_RC1) && (__type & MAY_BE_OBJECT)) {\ + /* TODO: object may be captured by magic handlers */\ + __type |= MAY_BE_RCN; \ + } \ if (__ssa_var->alias) { \ __type |= get_ssa_alias_types(__ssa_var->alias); \ } \ diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c index 0082d5311033e..b300f31a7e4cf 100644 --- a/ext/opcache/jit/zend_jit_ir.c +++ b/ext/opcache/jit/zend_jit_ir.c @@ -14621,6 +14621,7 @@ static int zend_jit_fetch_obj(zend_jit_ctx *jit, ir_MERGE_list(slow_inputs); jit_SET_EX_OPLINE(jit, opline); + op1_info |= MAY_BE_RC1 | MAY_BE_RCN; /* object may be captured/released in magic handler */ if (opline->opcode == ZEND_FETCH_OBJ_W) { ir_CALL_1(IR_VOID, ir_CONST_FC_FUNC(zend_jit_fetch_obj_w_slow), obj_ref); ir_END_list(end_inputs); diff --git a/ext/opcache/tests/jit/gh17151_1.phpt b/ext/opcache/tests/jit/gh17151_1.phpt new file mode 100644 index 0000000000000..57c9bd142b72f --- /dev/null +++ b/ext/opcache/tests/jit/gh17151_1.phpt @@ -0,0 +1,22 @@ +--TEST-- +GH-17151: ZEND_FETCH_OBJ_R may modify RC of op1 +--FILE-- +bar; + var_dump($x); +} + +test(); + +?> +--EXPECTF-- +object(C)#%d (0) { +} diff --git a/ext/opcache/tests/jit/gh17151_2.phpt b/ext/opcache/tests/jit/gh17151_2.phpt new file mode 100644 index 0000000000000..26e1acbab7d9e --- /dev/null +++ b/ext/opcache/tests/jit/gh17151_2.phpt @@ -0,0 +1,29 @@ +--TEST-- +GH-17151: ZEND_FETCH_OBJ_R may modify RC of op1 +--FILE-- +bar; +} + +test(); +echo "Done\n"; + +?> +--EXPECT-- +C::__destruct +Done diff --git a/ext/opcache/tests/jit/gh17151_3.phpt b/ext/opcache/tests/jit/gh17151_3.phpt new file mode 100644 index 0000000000000..5e42d357a68a7 --- /dev/null +++ b/ext/opcache/tests/jit/gh17151_3.phpt @@ -0,0 +1,25 @@ +--TEST-- +GH-17151: Method calls may modify RC of ZEND_INIT_METHOD_CALL op1 +--FILE-- +storeThis(); + $c = null; +} + +test(); + +?> +===DONE=== +--EXPECT-- +===DONE===