[php-src] Issue #22763: JIT fails to clear ZREG_TYPE_ONLY after setting reg

[email protected] (arnaud-lb) Thu, 16 Jul 2026 13:47:52 +0000
Newsgroups php.bugs
Message-ID <[email protected]>
Issue: https://github.com/php/php-src/issues/22763
Author: arnaud-lb

### Description

The following code:

```php
<?php

function findMiddleSnake(array $a, int $aLo, int $aHi, array $b, int $bLo, int $bHi): array
{
    $n          = $aHi - $aLo;
    $m          = $bHi - $bLo;
    $delta      = $n - $m;
    $deltaIsOdd = ($delta & 1) !== 0;
    $offset     = 4;
    $size       = 2 * 3 + 2;
    $vf         = array_fill(0, $size, 0);
    $vb         = array_fill(0, $size, 0);

    $d = 2;
    $x = 0;

    for ($k = -$d; $k <= $d; $k += 2) {
        if ($k === -$d || ($k !== $d && $vb[$offset + $k - 1] < $vb[$offset + $k + 1])) {
            $x = $vb[$offset + $k + 1];
            var_dump($x);
        } else {
            $x = $vb[$offset + $k - 1] + 1;
        }

        $y  = $x - $k;
        $xs = $x;
        $ys = $y;

        while ($x < $n && $y < $m && $a[$aLo + $n - 1 - $x] === $b[$bLo + $m - 1 - $y]) {
            $x++;
            $y++;
        }

        $vb[$offset + $k] = $x;

        if (!$deltaIsOdd) {
            $kf = $delta - $k;

            if ($kf >= -$d && $kf <= $d && $vf[$offset + $kf] + $vb[$offset + $k] >= $n) {
                return [$n - $x, $m - $y, $n - $xs, $m - $ys];
            }
        }
    }
}



$from = [3,2,1];
$to = [1,99,3];
findMiddleSnake($from, 0, count($from), $to, 0, count($to));
```

Resulted in this output:
```
int(0)
php: ext/opcache/jit/zend_jit_ir.c:1435: ir_ref zend_jit_use_reg(zend_jit_ctx *, zend_jit_addr): Assertion `jit->ra[var].flags & (1<<0)' failed.
```

### PHP Version

```plain
PHP 8.5
```

### Operating System

_No response_