Skip to content

Fix DO_UCALL may_be_trampoline flag to match DO_FCALL#21695

Closed
andypost wants to merge 1 commit intophp:masterfrom
skilld-labs:fix-do-ucall-may-be-trampoline
Closed

Fix DO_UCALL may_be_trampoline flag to match DO_FCALL#21695
andypost wants to merge 1 commit intophp:masterfrom
skilld-labs:fix-do-ucall-may-be-trampoline

Conversation

@andypost
Copy link
Copy Markdown
Contributor

@andypost andypost commented Apr 9, 2026

The ZEND_DO_UCALL handler hardcodes may_be_trampoline=0 when calling i_init_func_execute_data(), while ZEND_DO_FCALL passes 1. When the optimizer converts DO_FCALL to DO_UCALL for user functions that return by reference, the ASSIGN_REF opcode receives an incorrectly initialized return value, producing "Invalid opcode" errors or segfaults.

Closes #21691

The ZEND_DO_UCALL handler hardcodes may_be_trampoline=0 when calling
i_init_func_execute_data(), while ZEND_DO_FCALL passes 1. When the
optimizer converts DO_FCALL to DO_UCALL for user functions that return
by reference, the ASSIGN_REF opcode receives an incorrectly initialized
return value, producing "Invalid opcode" errors or segfaults.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@andypost andypost requested a review from dstogov as a code owner April 9, 2026 19:05
@andypost andypost closed this Apr 9, 2026
@andypost andypost deleted the fix-do-ucall-may-be-trampoline branch April 9, 2026 21:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

PHP 8.6 OPcache: DO_UCALL breaks reference returns (segfault / invalid opcode)

1 participant