Skip to content

Commit ba5d53d

Browse files
committed
Fix phpGH-17727: JIT SEGV on OOM in dtor when creating backtrace
This became visible after phpGH-17056 was merged, but technically the lack of setting the opline is also present on lower branches. We set the opline to mirror the SAVE_OPLINE() from ZEND_INIT_STATIC_METHOD_CALL().
1 parent dd66bb9 commit ba5d53d

File tree

2 files changed

+34
-0
lines changed

2 files changed

+34
-0
lines changed

ext/opcache/jit/zend_jit_ir.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9327,6 +9327,7 @@ static int zend_jit_init_static_method_call(zend_jit_ctx *jit,
93279327
ir_IF_FALSE_cold(if_static);
93289328
}
93299329

9330+
jit_SET_EX_OPLINE(jit, opline);
93309331
ref = ir_CALL_3(IR_ADDR, ir_CONST_FC_FUNC(zend_jit_push_this_method_call_frame),
93319332
scope_ref,
93329333
func_ref,

ext/opcache/tests/jit/gh17727.phpt

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
--TEST--
2+
GH-17727 (JIT SEGV on OOM in dtor when creating backtrace)
3+
--EXTENSIONS--
4+
opcache
5+
--SKIPIF--
6+
<?php
7+
if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
8+
?>
9+
--INI--
10+
opcache.jit=1254
11+
fatal_error_backtraces=1
12+
memory_limit=2M
13+
--CREDITS--
14+
arnaud-lb
15+
YuanchengJiang
16+
--FILE--
17+
<?php
18+
class DestructableObject
19+
{
20+
public function __destruct()
21+
{
22+
DestructableObject::__destruct();
23+
}
24+
}
25+
$_ = new DestructableObject();
26+
?>
27+
--EXPECTF--
28+
Fatal error: Allowed memory size of 2097152 bytes exhausted %s
29+
Stack trace:
30+
#0 %s(%d): DestructableObject->__destruct()
31+
%A
32+
#%d [internal function]: DestructableObject->__destruct()
33+
#%d {main}

0 commit comments

Comments
 (0)