Skip to content

Commit e2e2b3a

Browse files
committed
Fix GH-16168: php 8.1 and earlier crash immediately when compiled with Xcode 16 clang on macOS 15
The inline assembly uses labels with the prefix `.L`. On Linux systems this is the local label prefix. It appears that macOS uses `L` as a local prefix, which means that the prefix used in the inline assembly is not local for macOS systems [1]. When combined with inlining, this causes the compiler to get confused and merge a part of the inline assembly between different functions, causing control flow to jump from one function to another function. This is avoided on PHP 8.2 and up by the fact that it uses `zend_never_inline NOIPA`, but nothing guarantees that compiler changes won't affect this as well. To solve this issue, we instead use local labels. These will make the compiler pick the correct prefix, preventing the issue. Additionally, while here, we also change the computation of `delta`. It is undefined behaviour to compute the pointer difference between two different objects. To circumvent this, we cast first to `uintptr_t`. This change is cleanly backportable to 8.1 for vendors to pick up. [1] #16168 (comment) With the help of investigation and testing of @ryandesign. Closes GH-16348.
1 parent 1d0fbdf commit e2e2b3a

File tree

2 files changed

+24
-20
lines changed

2 files changed

+24
-20
lines changed

NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ PHP NEWS
55
- COM:
66
. Fixed out of bound writes to SafeArray data. (cmb)
77

8+
- Core:
9+
. Fixed bug GH-16168 (php 8.1 and earlier crash immediately when compiled
10+
with Xcode 16 clang on macOS 15). (nielsdos)
11+
812
- Curl:
913
. Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if
1014
curl_multi_add_handle fails). (timwolla)

Zend/zend_string.c

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -392,32 +392,32 @@ ZEND_API bool ZEND_FASTCALL I_REPLACE_SONAME_FNNAME_ZU(NONE,zend_string_equal_va
392392
ZEND_API zend_never_inline NOIPA bool ZEND_FASTCALL zend_string_equal_val(const zend_string *s1, const zend_string *s2)
393393
{
394394
const char *ptr = ZSTR_VAL(s1);
395-
size_t delta = (const char*)s2 - (const char*)s1;
395+
uintptr_t delta = (uintptr_t) s2 - (uintptr_t) s1;
396396
size_t len = ZSTR_LEN(s1);
397397
zend_ulong ret;
398398

399399
__asm__ (
400-
".LL0%=:\n\t"
400+
"0:\n\t"
401401
"movl (%2,%3), %0\n\t"
402402
"xorl (%2), %0\n\t"
403-
"jne .LL1%=\n\t"
403+
"jne 1f\n\t"
404404
"addl $0x4, %2\n\t"
405405
"subl $0x4, %1\n\t"
406-
"ja .LL0%=\n\t"
406+
"ja 0b\n\t"
407407
"movl $0x1, %0\n\t"
408-
"jmp .LL3%=\n\t"
409-
".LL1%=:\n\t"
408+
"jmp 3f\n\t"
409+
"1:\n\t"
410410
"cmpl $0x4,%1\n\t"
411-
"jb .LL2%=\n\t"
411+
"jb 2f\n\t"
412412
"xorl %0, %0\n\t"
413-
"jmp .LL3%=\n\t"
414-
".LL2%=:\n\t"
413+
"jmp 3f\n\t"
414+
"2:\n\t"
415415
"negl %1\n\t"
416416
"lea 0x20(,%1,8), %1\n\t"
417417
"shll %b1, %0\n\t"
418418
"sete %b0\n\t"
419419
"movzbl %b0, %0\n\t"
420-
".LL3%=:\n"
420+
"3:\n"
421421
: "=&a"(ret),
422422
"+c"(len),
423423
"+r"(ptr)
@@ -430,32 +430,32 @@ ZEND_API zend_never_inline NOIPA bool ZEND_FASTCALL zend_string_equal_val(const
430430
ZEND_API zend_never_inline NOIPA bool ZEND_FASTCALL zend_string_equal_val(const zend_string *s1, const zend_string *s2)
431431
{
432432
const char *ptr = ZSTR_VAL(s1);
433-
size_t delta = (const char*)s2 - (const char*)s1;
433+
uintptr_t delta = (uintptr_t) s2 - (uintptr_t) s1;
434434
size_t len = ZSTR_LEN(s1);
435435
zend_ulong ret;
436436

437437
__asm__ (
438-
".LL0%=:\n\t"
438+
"0:\n\t"
439439
"movq (%2,%3), %0\n\t"
440440
"xorq (%2), %0\n\t"
441-
"jne .LL1%=\n\t"
441+
"jne 1f\n\t"
442442
"addq $0x8, %2\n\t"
443443
"subq $0x8, %1\n\t"
444-
"ja .LL0%=\n\t"
444+
"ja 0b\n\t"
445445
"movq $0x1, %0\n\t"
446-
"jmp .LL3%=\n\t"
447-
".LL1%=:\n\t"
446+
"jmp 3f\n\t"
447+
"1:\n\t"
448448
"cmpq $0x8,%1\n\t"
449-
"jb .LL2%=\n\t"
449+
"jb 2f\n\t"
450450
"xorq %0, %0\n\t"
451-
"jmp .LL3%=\n\t"
452-
".LL2%=:\n\t"
451+
"jmp 3f\n\t"
452+
"2:\n\t"
453453
"negq %1\n\t"
454454
"lea 0x40(,%1,8), %1\n\t"
455455
"shlq %b1, %0\n\t"
456456
"sete %b0\n\t"
457457
"movzbq %b0, %0\n\t"
458-
".LL3%=:\n"
458+
"3:\n"
459459
: "=&a"(ret),
460460
"+c"(len),
461461
"+r"(ptr)

0 commit comments

Comments
 (0)