Skip to content

JIT: Fix AArch64 JIT encoding of invalid logical immediates - #24663

Open
jorgsowa wants to merge 1 commit into
php:PHP-8.4from
jorgsowa:fix-dasm-imm13-ub
Open

jorgsowa wants to merge 1 commit into
php:PHP-8.4from
jorgsowa:fix-dasm-imm13-ub

Conversation

@jorgsowa

Copy link
Copy Markdown
Contributor

Backport of the dasm_imm13() rewrite from DynASM (LuaJIT a9981441, LuaJIT/LuaJIT#1522), which landed in master with the IR update in #24298.

The old dasm_imm13() accepts some constants that are not valid AArch64 logical immediates and returns a bogus encoding. AND/OR/XOR with such a constant then:

  • computes a wrong result, e.g. $x & 0x5555555555555554 has bit 0 set
  • or emits an illegal instruction (SIGILL), e.g. $x & 0x200000003

It also negates INT64_MIN in signed arithmetic (UB).

Only dasm_imm13() and its helpers are taken from the DynASM update; the rest of that update stays in master.

dasm_imm13() accepted some non-encodable constants and returned a bogus
encoding, so AND/OR/XOR with them computed a wrong result
(0x5555555555555554) or emitted an illegal instruction (0x200000003).
It also negated INT64_MIN in signed arithmetic. Backport the rewritten
dasm_imm13() from DynASM (LuaJIT a9981441), already in master via the
IR update.
@jorgsowa jorgsowa self-assigned this Oct 24, 2026
@jorgsowa
jorgsowa requested a review from dstogov as a code owner October 24, 2026 20:30

@ndossche ndossche left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like a clean backport, thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants