Commit b4ca62e3178 for php
commit b4ca62e3178c63a75b42c3dee3a423849dff3f39
Author: waroad <dohanam2@illinois.edu>
Date: Sun Oct 18 06:05:19 2026 -0500
Tracing JIT: give the type guard on entry of an inlined call an exit opline
Assisted-by: Claude
Closes GH-24411.
diff --git a/NEWS b/NEWS
index 3d8db871d6c..599891f3b59 100644
--- a/NEWS
+++ b/NEWS
@@ -85,6 +85,8 @@ PHP NEWS
zend_jit_assign_dim_op()). (waroad)
. Fixed bug GH-24398 (JIT: minimal JIT segfault when a hooked property is
passed to a run-time-resolved function). (waroad)
+ . Fixed bug GH-24389 (Tracing JIT: type guard on entry of an inlined call
+ exits with an uninitialized opline). (waroad)
- PDO:
. Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated.
diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c
index 7c218a62306..dc0ae8eea51 100644
--- a/ext/opcache/jit/zend_jit_trace.c
+++ b/ext/opcache/jit/zend_jit_trace.c
@@ -6887,7 +6887,7 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
ssa->var_info[j].type &= ~MAY_BE_GUARD;
op_type = concrete_type(ssa->var_info[j].type);
- if (!zend_jit_type_guard(&ctx, NULL, EX_NUM_TO_VAR(i), op_type)) {
+ if (!zend_jit_type_guard(&ctx, (p+1)->opline, EX_NUM_TO_VAR(i), op_type)) {
goto jit_failure;
}
SET_STACK_TYPE(stack, i, op_type, 1);
diff --git a/ext/opcache/tests/jit/gh24389.phpt b/ext/opcache/tests/jit/gh24389.phpt
new file mode 100644
index 00000000000..8c8d5725f61
--- /dev/null
+++ b/ext/opcache/tests/jit/gh24389.phpt
@@ -0,0 +1,30 @@
+--TEST--
+GH-24389 (Tracing JIT: type guard on entry of an inlined call exits with an uninitialized opline)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=64M
+opcache.jit=tracing
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+function right($x, $y) {
+ $a = $x + $y;
+ return $x - $y;
+}
+function driver($x, $y) {
+ $xr = &$x;
+ $yr = &$y;
+ for ($i = 0; $i < 300; $i++) {
+ $r = right($x, $y);
+ }
+ return $r;
+}
+var_dump(driver(3, 2));
+var_dump(driver(3.5, 2.5));
+?>
+--EXPECT--
+int(1)
+float(1)