Commit 84da3f525a8 for php
commit 84da3f525a87fa47e3499c2acadc03466dec8677
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date: Sun Oct 18 10:18:40 2026 -0400
ext/opcache: Clear vacated MERGE inputs before conversion to BEGIN
BEGIN reserves op2 for a label, so stale MERGE inputs caused assertions
when dumping JIT IR and stopped aliasing searches at the block.
Fixes GH-24397
Closes GH-24419
diff --git a/NEWS b/NEWS
index 328c133c640..06945c2b7ba 100644
--- a/NEWS
+++ b/NEWS
@@ -136,6 +136,8 @@ PHP NEWS
cannot describe a parameter). (Ilia Alshanetsky)
- Opcache:
+ . Fixed bug GH-24397 (Assertion failure when dumping JIT IR).
+ (Ilia Alshanetsky)
. Fixed tracing JIT returning a wrapped integer instead of a float on
integer overflow after an integer was compared with a float or
numeric-string literal. (Ilia Alshanetsky)
diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c
index b54c2cddf1a..53959a536a4 100644
--- a/ext/opcache/jit/zend_jit_ir.c
+++ b/ext/opcache/jit/zend_jit_ir.c
@@ -3781,6 +3781,11 @@ static void _zend_jit_fix_merges(zend_jit_ctx *jit)
if (k != n) {
ir_ref n2, k2;
+ /* BEGIN reads op2 as a label, so clear the vacated inputs */
+ while (r != q) {
+ *r = IR_UNUSED;
+ r++;
+ }
if (k <= 1) {
insn->op = IR_BEGIN;
insn->inputs_count = 0;
diff --git a/ext/opcache/tests/jit/gh24397.phpt b/ext/opcache/tests/jit/gh24397.phpt
new file mode 100644
index 00000000000..1ef87a66f3d
--- /dev/null
+++ b/ext/opcache/tests/jit/gh24397.phpt
@@ -0,0 +1,23 @@
+--TEST--
+GH-24397 (JIT: stale label operand on a MERGE reduced to BEGIN)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=64M
+opcache.jit=function
+opcache.jit_debug=0x1000000
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+function f() {
+ foreach ([1, 2] as $v) {
+ $c[] = $v;
+ }
+}
+f();
+echo "Done\n";
+?>
+--EXPECTF--
+%ADone