-
Notifications
You must be signed in to change notification settings - Fork 7.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Incorrect result with reflection in low-trigger JIT #16572
Comments
Reduce to: <?php
function dumpType(ReflectionType $rt) {
var_dump($rt::class);
dumpType(null);
}
function test1(): int { }
dumpType((new ReflectionFunction('test1'))->getReturnType()); |
It appears the bug is related to |
When a recursive call happens with invalid arguments, the maximum valid arguments are computed and stored in `num_args`, but the RECV entry block we jump to is `call_num_args` instead. This can skip argument validation checks. Fix this by using `num_args` instead.
When a recursive call happens with invalid arguments, the maximum valid arguments are computed and stored in `num_args`, but the RECV entry block we jump to is `call_num_args` instead. This can skip argument validation checks. Fix this by using `num_args` instead.
Description
The following code:
Resulted in this output (with JIT 1215):
But I expected this output instead:
This could potentially lead to segfault.
PHP Version
nightly
Operating System
ubuntu 22.04
The text was updated successfully, but these errors were encountered: