Skip to content

ext/opcache: Fix GH-23679 tracing JIT shadowed private writes - #307

Closed
iliaal wants to merge 1 commit into
PHP-8.5from
fix/gh-23679-shadowed-private-property
Closed

iliaal wants to merge 1 commit into
PHP-8.5from
fix/gh-23679-shadowed-private-property

Conversation

@iliaal

@iliaal iliaal commented Sep 13, 2026

Copy link
Copy Markdown
Owner

Tracing JIT specialised $clone->prop writes in a parent method to a child's public property of the same name (ZEND_ACC_CHANGED). zend_get_known_property_info now refuses that known-offset path when the executing scope is not the object's class, so the runtime cache populated by zend_get_property_offset is used instead. FETCH_OBJ_W, ASSIGN_OBJ, INC, and ASSIGN_OBJ_OP share the helper; $this access, child methods, and unshadowed properties do not. Fixes php#23679

zend_get_known_property_info treated a ZEND_ACC_CHANGED public property as
the known offset even when the executing scope owned a private property of
the same name, so tracing JIT wrote through a child's public slot.
Returning NULL uses the runtime-cache path, which already goes through
zend_get_property_offset. FETCH_OBJ_W, ASSIGN_OBJ, INC, and ASSIGN_OBJ_OP
share the helper; $this access, child methods, and unshadowed or
protected-to-public properties do not hit this arm.

Fixes phpGH-23679
@iliaal

iliaal commented Sep 13, 2026

Copy link
Copy Markdown
Owner Author

Opened upstream as php#23683

@iliaal iliaal closed this Sep 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant