Skip to content

Fix GH-21691: OPcache CFG optimizer eliminates QM_ASSIGN feeding JMPZ with VAR operand#21696

Open
iliaal wants to merge 1 commit intophp:masterfrom
iliaal:fix/gh-21691-opcache-jmpz-var
Open

Fix GH-21691: OPcache CFG optimizer eliminates QM_ASSIGN feeding JMPZ with VAR operand#21696
iliaal wants to merge 1 commit intophp:masterfrom
iliaal:fix/gh-21691-opcache-jmpz-var

Conversation

@iliaal
Copy link
Copy Markdown
Contributor

@iliaal iliaal commented Apr 9, 2026

Fixes #21691

The CFG optimizer (pass 5) removed a QM_ASSIGN that converted IS_VAR to IS_TMP_VAR before JMPZ. Since JMPZ has no handler for IS_VAR operands, this produced "Invalid opcode 43/4/0." The pattern occurs when ASSIGN_REF (which produces IS_VAR) feeds into a conditional via QM_ASSIGN.

Skips the QM_ASSIGN elimination when the source operand is IS_VAR.

…MPZ with VAR operand

The CFG optimizer (pass 5) removed a QM_ASSIGN that converted IS_VAR
to IS_TMP_VAR before JMPZ. JMPZ has no handler for IS_VAR operands,
producing "Invalid opcode 43/4/0." This occurred when ASSIGN_REF
(which produces IS_VAR) fed into a conditional via QM_ASSIGN.

Skip the QM_ASSIGN elimination when the source operand is IS_VAR.

Closes phpGH-21691
@andypost
Copy link
Copy Markdown
Contributor

andypost commented Apr 9, 2026

Confirm it fixes running test for Drupal, used as patch and tests pass https://git.drupalcode.org/project/drupal/-/jobs/9303090

Copy link
Copy Markdown
Member

@dstogov dstogov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The fix is right but incomplete.
The similar checks have to be added at least for ZEND_BOOL_NOT above and for ZEND_JMPN?Z_EX below.

I would add these IS_VAR checks into the conditions chains to avoid additional break. (but this is really not critical, and both decisions may have their advantages).

@iluuu1994 please also take a look. This is relate to ""VAR|TMP overhaul (GH-20628)"".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

PHP 8.6 OPcache: DO_UCALL breaks reference returns (segfault / invalid opcode)

3 participants