diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c index 947e87f09cb3..4c574a39a155 100644 --- a/ext/opcache/jit/zend_jit_ir.c +++ b/ext/opcache/jit/zend_jit_ir.c @@ -13577,9 +13577,10 @@ static int zend_jit_assign_dim_op(zend_jit_ctx *jit, if (!zend_jit_spill_store_inv(jit, op3_addr, real_addr, op1_data_info)) { return 0; } - op3_addr = real_addr; + arg2 = jit_ZVAL_ADDR(jit, real_addr); + } else { + arg2 = jit_ZVAL_ADDR(jit, op3_addr); } - arg2 = jit_ZVAL_ADDR(jit, op3_addr); ir_CALL_3(IR_VOID, ir_CONST_FC_FUNC(zend_jit_assign_op_to_typed_ref), reference, arg2, ir_CONST_FC_FUNC(binary_op)); diff --git a/ext/opcache/tests/jit/gh24437.phpt b/ext/opcache/tests/jit/gh24437.phpt new file mode 100644 index 000000000000..35b25e0d4aa8 --- /dev/null +++ b/ext/opcache/tests/jit/gh24437.phpt @@ -0,0 +1,50 @@ +--TEST-- +GH-24437 (JIT: tracing JIT gives wrong sum for `$a[0] += $i + 1` on an array parameter in a loop) +--EXTENSIONS-- +opcache +--INI-- +opcache.enable=1 +opcache.enable_cli=1 +opcache.jit=tracing +--FILE-- + 2])); +$x = 10; +var_dump(g([&$x]), $x); +$c = new C; +var_dump(g([&$c->prop]), $c->prop); +@h([]); +?> +DONE +--EXPECT-- +int(6) +int(16) +int(16) +int(16) +int(16) +DONE