From 2f1a94ef3c7bf0deb747c47403f681bbc8bafd5b Mon Sep 17 00:00:00 2001 From: Ilija Tovilo Date: Tue, 7 Apr 2026 22:51:49 +0200 Subject: [PATCH 1/2] Add EG(bailout) consistency assertion Make sure EG(bailout) is what we expect. This will detect faulty jumps into or out of zend_try blocks, as in 38628e8. --- Zend/zend.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Zend/zend.h b/Zend/zend.h index ebb7d23919555..b41693639ca08 100644 --- a/Zend/zend.h +++ b/Zend/zend.h @@ -281,7 +281,9 @@ typedef size_t (*zend_write_func_t)(const char *str, size_t str_length); EG(bailout) = &__bailout; \ if (SETJMP(__bailout)==0) { #define zend_catch \ + ZEND_ASSERT(EG(bailout) == &__bailout); \ } else { \ + ZEND_ASSERT(EG(bailout) == &__bailout); \ EG(bailout) = __orig_bailout; #define zend_end_try() \ } \ From f1ac8dfe08328c4d50f463d47bb259d22bfcc3cf Mon Sep 17 00:00:00 2001 From: Ilija Tovilo Date: Wed, 8 Apr 2026 00:00:25 +0200 Subject: [PATCH 2/2] Fix faulty zend_try handling in zend_jit_trace() --- ext/opcache/jit/zend_jit_trace.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/ext/opcache/jit/zend_jit_trace.c b/ext/opcache/jit/zend_jit_trace.c index 0aa294fdbff4a..696a99035a78a 100644 --- a/ext/opcache/jit/zend_jit_trace.c +++ b/ext/opcache/jit/zend_jit_trace.c @@ -5218,7 +5218,7 @@ static zend_vm_opcode_handler_t zend_jit_trace(zend_jit_trace_rec *trace_buffer, && ssa->vars[ssa_op->op2_def].use_chain < 0 && !ssa->vars[ssa_op->op2_def].phi_use_chain) { if (!zend_jit_store_type(&ctx, var_num, type)) { - return 0; + goto jit_failure; } SET_STACK_TYPE(stack, var_num, type, 1); } @@ -5271,7 +5271,7 @@ static zend_vm_opcode_handler_t zend_jit_trace(zend_jit_trace_rec *trace_buffer, && ssa->vars[ssa_op->op1_def].use_chain < 0 && !ssa->vars[ssa_op->op1_def].phi_use_chain) { if (!zend_jit_store_type(&ctx, var_num, type)) { - return 0; + goto jit_failure; } SET_STACK_TYPE(stack, var_num, type, 1); } @@ -5368,7 +5368,7 @@ static zend_vm_opcode_handler_t zend_jit_trace(zend_jit_trace_rec *trace_buffer, && ssa->vars[ssa_op->op1_def].use_chain < 0 && !ssa->vars[ssa_op->op1_def].phi_use_chain) { if (!zend_jit_store_type(&ctx, var_num, type)) { - return 0; + goto jit_failure; } SET_STACK_TYPE(stack, var_num, type, 1); } @@ -6627,7 +6627,7 @@ static zend_vm_opcode_handler_t zend_jit_trace(zend_jit_trace_rec *trace_buffer, var_num = EX_VAR_TO_NUM(var_num); if (!zend_jit_store_type(&ctx, var_num, type)) { - return 0; + goto jit_failure; } SET_STACK_TYPE(stack, var_num, type, 1); } @@ -7266,7 +7266,7 @@ static zend_vm_opcode_handler_t zend_jit_trace(zend_jit_trace_rec *trace_buffer, && type != STACK_MEM_TYPE(stack, i) && zend_jit_trace_must_store_type(op_array, op_array_ssa, opline - op_array->opcodes, i, type)) { if (!zend_jit_store_type(jit, i, type)) { - return 0; + goto jit_failure; } SET_STACK_TYPE(stack, i, type, 1); } @@ -7387,11 +7387,11 @@ static zend_vm_opcode_handler_t zend_jit_trace(zend_jit_trace_rec *trace_buffer, zend_string_release(name); } +jit_cleanup:; } zend_catch { do_bailout = 1; } zend_end_try(); -jit_cleanup: /* Clean up used op_arrays */ while (num_op_arrays > 0) { op_array = op_arrays[--num_op_arrays];