[php-src] Issue #21158: JIT: Assertion jit->ra[var].flags & (1<<0) failed in zend_jit_use_reg

[email protected] (YuanchengJiang)
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/21158
Author: YuanchengJiang

### Description

The following code:

```php
<?php
define('ROW', 10);
define('COL', 10);
function initialize_board(&$board) {
for ($i = 0; $i < ROW; $i++) {
for ($j = 0; $j < COL; $j++) {
$board[$i][$j] = rand(0, 1);
}
}
}
function print_board($board) {
for ($i = 0; $i < ROW; $i++) {
for ($j = 0; $j < COL; $j++) {
echo $board[$i][$j] . " ";
}
echo "\n";
}
}
function count_live_neighbors($board, $row, $col) {
$live_neighbors = 0;
if ($row - 1 >= 0 && $board[$row - 1][$col] == 1) $live_neighbors++;
if ($row + 1 < ROW && $board[$row + 1][$col] == 1) $live_neighbors++;
if ($col - 1 >= 0 && $board[$row][$col - 1] == 1) $live_neighbors++;
if ($col + 1 < COL && $board[$row][$col + 1] == 1) $live_neighbors++;
if ($row - 1 >= 0 && $col - 1 >= 0 && $board[$row - 1][$col - 1] == 1) $live_neighbors++;
if ($row - 1 >= 0 && $col + 1 < COL && $board[$row - 1][$col + 1] == 1) $live_neighbors++;
if ($row + 1 < ROW && $col - 1 >= 0 && $board[$row + 1][$col - 1] == 1) $live_neighbors++;
if ($row + 1 < ROW && $col + 1 < COL && $board[$row + 1][$col + 1] == 1) $live_neighbors++;
return $live_neighbors;
}
$board = array();
srand(time());
initialize_board($board);
print_board($board);
echo "\n";
for ($t = 0; $t < 10; $t++) {
$new_board = array();
for ($i = 0; $i < ROW; $i++) {
for ($j = 0; $j < COL; $j++) {
$live_neighbors = count_live_neighbors($board, $i, $j);
if ($board[$i][$j] == 1 && ($live_neighbors < 2 || $live_neighbors > 3))
$new_board[$i][$j] = 0;
else if ($board[$i][$j] == 0 && $live_neighbors == 3)
$new_board[$i][$j] = 1;
else
$new_board[$i][$j] = $board[$i][$j];
}
}
for ($i = 0; $i < ROW; $i++) {
for ($j = 0; $j < COL; $j++) {
$board[$i][$j] = $new_board[$i][$j];
}
}
print_board($board);
echo "\n";
}
echo (1%1.5)-(1.5%1%1%-1)-1;
var_dump(get_defined_vars());
```

Resulted in this output:
```
php: ext/opcache/jit/zend_jit_ir.c:1435: ir_ref zend_jit_use_reg(zend_jit_ctx *, zend_jit_addr): Assertion `jit->ra[var].flags & (1<<0)' failed.
Aborted (core dumped)
```

To reproduce:
```
./php-src/sapi/cli/php -d "opcache.enable=1" -d "opcache.enable_cli=1" -d "opcache.jit=1254" ./test.php
```

Commit:
```
52e9436629061a7a5280011abbb104f4be9a7e2b
```

Configurations:
```
CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv
```

Operating System:
```
Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest
```

*This report is automatically generated by [FlowFusion](https://github.com/php/flowfusion)*

sorry for large reproducer, it is hard to reduce in this case

### PHP Version

```plain
nightly
```

### Operating System

_No response_
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.