Skip to content

Commit a54ed9e

Browse files
committed
Fix GH-17727: JIT SEGV on OOM in dtor when creating backtrace
This became visible after GH-17056 was merged, but technically the lack of setting the opline is also present on lower branches. We set the opline to mirror the SAVE_OPLINE() from ZEND_INIT_STATIC_METHOD_CALL(). Closes GH-17732.
1 parent 033a66b commit a54ed9e

File tree

2 files changed

+32
-0
lines changed

2 files changed

+32
-0
lines changed

ext/opcache/jit/zend_jit_ir.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9327,6 +9327,7 @@ static int zend_jit_init_static_method_call(zend_jit_ctx *jit,
93279327
ir_IF_FALSE_cold(if_static);
93289328
}
93299329

9330+
jit_SET_EX_OPLINE(jit, opline);
93309331
ref = ir_CALL_3(IR_ADDR, ir_CONST_FC_FUNC(zend_jit_push_this_method_call_frame),
93319332
scope_ref,
93329333
func_ref,

ext/opcache/tests/jit/gh17727.phpt

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
--TEST--
2+
GH-17727 (JIT SEGV on OOM in dtor when creating backtrace)
3+
--EXTENSIONS--
4+
opcache
5+
--SKIPIF--
6+
<?php
7+
if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
8+
?>
9+
--INI--
10+
opcache.jit=1254
11+
fatal_error_backtraces=1
12+
memory_limit=2M
13+
--CREDITS--
14+
arnaud-lb
15+
YuanchengJiang
16+
--FILE--
17+
<?php
18+
$str = str_repeat('a', 1024 * 1024 * 1.25);
19+
class DestructableObject
20+
{
21+
public function __destruct()
22+
{
23+
DestructableObject::__destruct();
24+
}
25+
}
26+
$_ = new DestructableObject();
27+
?>
28+
--EXPECTF--
29+
Fatal error: Allowed memory size of 2097152 bytes exhausted %s
30+
Stack trace:
31+
%A

0 commit comments

Comments
 (0)