Skip to content

Fix GH-15652: Segmentation fault in the Zend engine when JIT enabled #15717

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 2, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions ext/opcache/jit/zend_jit.c
Original file line number Diff line number Diff line change
Expand Up @@ -669,16 +669,16 @@ static zend_property_info* zend_get_known_property_info(const zend_op_array *op_
return NULL;
}

static bool zend_may_be_dynamic_property(zend_class_entry *ce, zend_string *member, bool on_this, zend_string *filename)
static bool zend_may_be_dynamic_property(zend_class_entry *ce, zend_string *member, bool on_this, const zend_op_array *op_array)
{
zend_property_info *info;

if (!ce || (ce->ce_flags & ZEND_ACC_TRAIT)) {
if (!ce || (ce->ce_flags & ZEND_ACC_TRAIT) || (op_array->fn_flags & ZEND_ACC_TRAIT_CLONE)) {
return 1;
}

if (!(ce->ce_flags & ZEND_ACC_IMMUTABLE)) {
if (ce->info.user.filename != filename) {
if (ce->info.user.filename != op_array->filename) {
/* class declaration might be changed independently */
return 1;
}
Expand Down
2 changes: 1 addition & 1 deletion ext/opcache/jit/zend_jit_arm64.dasc
Original file line number Diff line number Diff line change
Expand Up @@ -12200,7 +12200,7 @@ static int zend_jit_fetch_obj(dasm_State **Dst,
| cmp REG2, TMP1
| bne >5
| MEM_ACCESS_64_WITH_UOFFSET ldr, REG0, REG0, ((opline->extended_value & ~ZEND_FETCH_OBJ_FLAGS) + sizeof(void*)), TMP1
may_be_dynamic = zend_may_be_dynamic_property(ce, Z_STR_P(member), opline->op1_type == IS_UNUSED, op_array->filename);
may_be_dynamic = zend_may_be_dynamic_property(ce, Z_STR_P(member), opline->op1_type == IS_UNUSED, op_array);
if (may_be_dynamic) {
| tst REG0, REG0
if (opline->opcode == ZEND_FETCH_OBJ_W) {
Expand Down
2 changes: 1 addition & 1 deletion ext/opcache/jit/zend_jit_x86.dasc
Original file line number Diff line number Diff line change
Expand Up @@ -12964,7 +12964,7 @@ static int zend_jit_fetch_obj(dasm_State **Dst,
| cmp r2, aword [FCARG1a + offsetof(zend_object, ce)]
| jne >5
| mov r0, aword [r0 + (opline->extended_value & ~ZEND_FETCH_OBJ_FLAGS) + sizeof(void*)]
may_be_dynamic = zend_may_be_dynamic_property(ce, Z_STR_P(member), opline->op1_type == IS_UNUSED, op_array->filename);
may_be_dynamic = zend_may_be_dynamic_property(ce, Z_STR_P(member), opline->op1_type == IS_UNUSED, op_array);
if (may_be_dynamic) {
| test r0, r0
if (opline->opcode == ZEND_FETCH_OBJ_W) {
Expand Down
46 changes: 46 additions & 0 deletions ext/opcache/tests/jit/gh15652.phpt
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
--TEST--
JIT: FETCH_OBJ 007
--INI--
opcache.enable=1
opcache.enable_cli=1
opcache.file_update_protection=0
opcache.jit_buffer_size=1M
opcache.jit_hot_func=2
--FILE--
<?php
class C {}

trait T {
public function equal(C $type): bool {
return $type instanceof self && $this->value === $type->value;
}
}

class C1 extends C {
use T;
public function __construct(private int $value) {}
}

class C2 extends C {
use T;
}

$x = new C1(1);
var_dump($x->equal($x));
var_dump($x->equal($x));
$a = new C2("aaa");
var_dump($a->equal($a));
var_dump($a->equal($a));
--EXPECTF--
bool(true)
bool(true)

Warning: Undefined property: C2::$value in %sgh15652.php on line 6

Warning: Undefined property: C2::$value in %sgh15652.php on line 6
bool(true)

Warning: Undefined property: C2::$value in %sgh15652.php on line 6

Warning: Undefined property: C2::$value in %sgh15652.php on line 6
bool(true)
Loading