Tracing JIT: Fixed ADD with two references to arrays

Author: dstogov

ext/opcache/jit/zend_jit_x86.dasc

@@ -4659,7 +4659,7 @@ static int zend_jit_math_helper(dasm_State    **Dst,
 {
 	zend_bool same_ops = zend_jit_same_addr(op1_addr, op2_addr);
 
-	if ((op1_info & MAY_BE_LONG) && (op2_info & MAY_BE_LONG)) {
+	if ((op1_info & MAY_BE_LONG) && (op2_info & MAY_BE_LONG) && (res_info & (MAY_BE_LONG|MAY_BE_DOUBLE))) {
 		if (op1_info & (MAY_BE_ANY-MAY_BE_LONG)) {
 			if (op1_info & MAY_BE_DOUBLE) {
 				|	IF_NOT_ZVAL_TYPE op1_addr, IS_LONG, >3
@@ -4720,7 +4720,8 @@ static int zend_jit_math_helper(dasm_State    **Dst,
 		}
 	} else if ((op1_info & MAY_BE_DOUBLE) &&
 	           !(op1_info & MAY_BE_LONG) &&
-	           (op2_info & (MAY_BE_LONG|MAY_BE_DOUBLE))) {
+	           (op2_info & (MAY_BE_LONG|MAY_BE_DOUBLE)) &&
+	           (res_info & MAY_BE_DOUBLE)) {
 		if (op1_info & (MAY_BE_ANY-MAY_BE_DOUBLE)) {
 			|	IF_NOT_ZVAL_TYPE op1_addr, IS_DOUBLE, >6
 		}
@@ -4754,7 +4755,8 @@ static int zend_jit_math_helper(dasm_State    **Dst,
 		}
 	} else if ((op2_info & MAY_BE_DOUBLE) &&
 	           !(op2_info & MAY_BE_LONG) &&
-	           (op1_info & (MAY_BE_LONG|MAY_BE_DOUBLE))) {
+	           (op1_info & (MAY_BE_LONG|MAY_BE_DOUBLE)) &&
+	           (res_info & MAY_BE_DOUBLE)) {
 		if (op2_info & (MAY_BE_ANY-MAY_BE_DOUBLE)) {
 			|	IF_NOT_ZVAL_TYPE op2_addr, IS_DOUBLE, >6
 		}
@@ -4793,7 +4795,8 @@ static int zend_jit_math_helper(dasm_State    **Dst,
 	if ((op1_info & ((MAY_BE_ANY|MAY_BE_UNDEF)-(MAY_BE_LONG|MAY_BE_DOUBLE))) ||
 		(op2_info & ((MAY_BE_ANY|MAY_BE_UNDEF)-(MAY_BE_LONG|MAY_BE_DOUBLE)))) {
 		if ((op1_info & (MAY_BE_LONG|MAY_BE_DOUBLE)) &&
-		    (op2_info & (MAY_BE_LONG|MAY_BE_DOUBLE))) {
+		    (op2_info & (MAY_BE_LONG|MAY_BE_DOUBLE)) &&
+		    (res_info & (MAY_BE_LONG|MAY_BE_DOUBLE))) {
 			|.cold_code
 		}
 		|6:
@@ -4855,7 +4858,8 @@ static int zend_jit_math_helper(dasm_State    **Dst,
 			}
 		}
 		if ((op1_info & (MAY_BE_LONG|MAY_BE_DOUBLE)) &&
-		    (op2_info & (MAY_BE_LONG|MAY_BE_DOUBLE))) {
+		    (op2_info & (MAY_BE_LONG|MAY_BE_DOUBLE)) &&
+		    (res_info & (MAY_BE_LONG|MAY_BE_DOUBLE))) {
 			|	jmp <5
 			|.code
 		}

ext/opcache/tests/jit/add_009.phpt

@@ -0,0 +1,15 @@
+--TEST--
+JIT ADD: 009 two array references
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+--FILE--
+<?php
+$a = []; 
+var_dump(($b =& $a) + ($b =& $a));
+?>
+--EXPECT--
+array(0) {
+}