Edit report at https://bugs.php.net/bug.php?id=80243&edit=1
ID: 80243
Updated by: nikic@php.net
Reported by: jens-erik dot riedel at kippdata dot de
Summary: OPCache JIT segfaults at startup
Status: Open
Type: Bug
Package: JIT
Operating System: RHEL 8.0
PHP Version: 8.0.0rc1
Block user comment: N
Private report: N
New Comment:
D->section is initialized by dasm_setup(), and that does get called directly before the stub is
compiled. Not clear to me how it ends up being NULL.
Previous Comments:
------------------------------------------------------------------------
[2020-10-19 15:51:10] ricardo at banak dot com
And same in PHP 8.0.0RC2
------------------------------------------------------------------------
[2020-10-19 15:48:52] ricardo at banak dot com
It also happens in Centos 8 and Centos 7.
------------------------------------------------------------------------
[2020-10-19 15:00:21] brainpower at mailbox dot org
I've got the same crash on Debian 10 buster, with 8.0.0rc1 and 8.0.0rc2,
so it still crashes with rc2.
According to gdb it seems that *sec/D->section is NULL:
(gdb) r
Starting program: /opt/php80/bin/php -dopcache.enable_cli=1 -dopcache.jit=1205
-dopcache.jit_buffer_size=32M Zend/bench.php
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Program received signal SIGSEGV, Segmentation fault.
dasm_put (Dst=Dst@entry=0x7fffffffcbf0, start=start@entry=5) at
/root/shmbuild/src/php-8.0.0RC2/ext/opcache/jit/dynasm/dasm_x86.h:176
176 int pos = sec->pos, ofs = sec->ofs, mrm = -1;
(gdb) bt
#0 dasm_put (Dst=Dst@entry=0x7fffffffcbf0, start=start@entry=5) at
/root/shmbuild/src/php-8.0.0RC2/ext/opcache/jit/dynasm/dasm_x86.h:176
#1 0x00007ffff356a703 in zend_jit_interrupt_handler_stub (Dst=0x7fffffffcbf0) at
/root/shmbuild/src/php-8.0.0RC2/ext/opcache/jit/zend_jit_x86.dasc:1726
#2 0x00007ffff35b8727 in zend_jit_make_stubs () at
/root/shmbuild/src/php-8.0.0RC2/ext/opcache/jit/zend_jit.c:3999
#3 zend_jit_startup (buf=<optimized out>, size=size@entry=33554432,
reattached=reattached@entry=false) at
/root/shmbuild/src/php-8.0.0RC2/ext/opcache/jit/zend_jit.c:4249
#4 0x00007ffff34da66f in accel_post_startup () at
/root/shmbuild/src/php-8.0.0RC2/ext/opcache/ZendAccelerator.c:3039
#5 0x0000555555b48f82 in zend_post_startup () at /root/shmbuild/src/php-8.0.0RC2/Zend/zend.c:1030
#6 0x0000555555ae8853 in php_module_startup (sf=<optimized out>,
additional_modules=<optimized out>, num_additional_modules=<optimized out>)
at /root/shmbuild/src/php-8.0.0RC2/main/main.c:2240
#7 0x0000555555bd01dd in php_cli_startup (sapi_module=<optimized out>) at
/root/shmbuild/src/php-8.0.0RC2/sapi/cli/php_cli.c:406
#8 0x00005555557a061d in main (argc=5, argv=0x555556bb95e0) at
/root/shmbuild/src/php-8.0.0RC2/sapi/cli/php_cli.c:1303
(gdb) list
171 {
172 va_list ap;
173 dasm_State *D = Dst_REF;
174 dasm_ActList p = D->actionlist + start;
175 dasm_Section *sec = D->section;
176 int pos = sec->pos, ofs = sec->ofs, mrm = -1;
177 int *b;
178
179 if (pos >= sec->epos) {
180 DASM_M_GROW(Dst, int, sec->buf, sec->bsize,
(gdb) print sec
$1 = (dasm_Section *) 0x0
(gdb) print D
$2 = (dasm_State *) 0x7ffff3609100
------------------------------------------------------------------------
[2020-10-15 19:29:32] jens-erik dot riedel at kippdata dot de
Description:
------------
When starting PHP 8.0.0rc1 with OPcache JIT enabled (i.e. opcache.jit_buffer_size is greater than
zero), it segfaults just when loading and initializing the opcache extension. The segfault can be
reproduced simply by calling "php -v" or "php -i" without executing any PHP
script.
This segfault does not occur in 8.0.0beta3.
This segfault does not occur if the opcache extension is loaded and JIT is disabled by setting
opcache.jit_buffer_size=0M.
Short analysis of core dump by "coredumpctl info":
PID: 14163 (php)
UID: 1200 (esuppbld)
GID: 1200 (esupport)
Signal: 11 (SEGV)
Timestamp: Thu 2020-10-15 16:15:01 CEST (1min 43s ago)
Command Line: /opt/products/php80/8.0.0rc1-1/bin/php -c /opt/instances/php80-fpm/lib/php.ini -d
opcache.enable_cli=1 -i
Executable: /opt/products/php80/8.0.0rc1-1/bin/php
Control Group: /user.slice/user-57.slice/session-4.scope
Unit: session-4.scope
Slice: user-57.slice
Session: 4
Owner UID: 57
Boot ID: 945e91c3455b429db5721734b2209ea8
Machine ID: 0f3498c0144645538a1771de48e97826
Hostname: est-rhel8-64
Storage:
/var/lib/systemd/coredump/core.php.1200.945e91c3455b429db5721734b2209ea8.14163.1602771301000000.lz4
Message: Process 14163 (php) of user 1200 dumped core.
Stack trace of thread 14163:
#0 0x00007f604414d165 dasm_put (opcache.so)
#1 0x00007f604416cd40 zend_jit_interrupt_handler_stub (opcache.so)
#2 0x00007f60441ba607 zend_jit_make_stubs (opcache.so)
#3 0x00007f60440dbf28 accel_post_startup (opcache.so)
#4 0x00007f6047b162ed zend_post_startup (libphp80.so.0)
#5 0x00007f6047ab6b39 php_module_startup (libphp80.so.0)
#6 0x0000000000404b6d php_cli_startup (php)
#7 0x000000000040453c main (php)
#8 0x00007f60462e7813 __libc_start_main (libc.so.6)
#9 0x00000000004047de _start (php)
php.ini settings:
memory_limit = 16M
upload_max_filesize = 20M
zend_extension=opcache
assert.active = Off
opcache.enable=1
opcache.log_verbosity_level=3
opcache.jit=1235
opcache.jit_buffer_size=1M
opcache.jit_debug=1
Expected result:
----------------
The execution of "php -v" should output:
PHP 8.0.0rc1 (cli) (built: Oct 9 2020 00:23:22)
Copyright (c) The PHP Group
Zend Engine v4.0.0-dev, Copyright (c) Zend Technologies
with Zend OPcache v8.0.0rc1, Copyright (c), by Zend Technologies
Actual result:
--------------
The execution of "php -v" crashes with SegV.
Backtrace via gdb:
#0 dasm_put (Dst=Dst@entry=0x7ffdd80b9cc0, start=start@entry=0)
at /bld/php80/ext/opcache/jit/dynasm/dasm_x86.h:176
#1 0x00007f604416cd40 in zend_jit_interrupt_handler_stub (Dst=0x7ffdd80b9cc0)
at /bld/php80/ext/opcache/jit/zend_jit_x86.dasc:1712
#2 0x00007f60441ba607 in zend_jit_make_stubs ()
at /bld/php80/ext/opcache/jit/zend_jit.c:3950
#3 zend_jit_startup (buf=<optimized out>, size=size@entry=1048576,
reattached=reattached@entry=false)
at /bld/php80/ext/opcache/jit/zend_jit.c:4200
#4 0x00007f60440dbf28 in accel_post_startup ()
at /bld/php80/ext/opcache/ZendAccelerator.c:3039
#5 0x00007f6047b162ed in zend_post_startup () at /bld/php80/Zend/zend.c:1030
#6 0x00007f6047ab6b39 in php_module_startup (sf=<optimized out>,
additional_modules=additional_modules@entry=0x0,
num_additional_modules=num_additional_modules@entry=0)
at /bld/php80/main/main.c:2267
#7 0x0000000000404b6d in php_cli_startup (sapi_module=<optimized out>)
at /bld/php80/sapi/cli/php_cli.c:407
#8 0x000000000040453c in main (argc=6, argv=0x15df6c0)
at /bld/php80/sapi/cli/php_cli.c:1304
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=80243&edit=1