Edit report at https://bugs.php.net/bug.php?id=80243&edit=1
ID: 80243
User updated by: jens-erik dot riedel at kippdata dot de
Reported by: jens-erik dot riedel at kippdata dot de
Summary: OPCache JIT segfaults at startup
Status: Open
Type: Bug
Package: JIT
Operating System: RHEL 8.0
PHP Version: 8.0.0rc1
Block user comment: N
Private report: N
New Comment:
I have tried with USE_ZEND_ALLOC=0 (using 8.0.0rc1 on RHEL 8). It crashes again; I don't know
if this qualifies as "crashes harder" but at least it crashes differently.
$ USE_ZEND_ALLOC=0 /opt/products/php80/8.0.0rc1-1/bin/php -c /opt/instances/php80-fpm/lib/php.ini -d
opcache.enable_cli=1 -i
free(): double free detected in tcache 2
Aborted (core dumped)
Backtrace is as follows:
Core was generated by `/opt/products/php80/8.0.0rc1-1/bin/php -c
/opt/instances/php80-fpm/lib/php.ini'.
Program terminated with signal SIGABRT, Aborted.
#0 0x00007f88746e893f in raise () from /lib64/libc.so.6
(gdb) bt
#0 0x00007f88746e893f in raise () from /lib64/libc.so.6
#1 0x00007f88746d2c95 in abort () from /lib64/libc.so.6
#2 0x00007f887472bd57 in __libc_message () from /lib64/libc.so.6
#3 0x00007f887473268c in malloc_printerr () from /lib64/libc.so.6
#4 0x00007f8874734155 in _int_free () from /lib64/libc.so.6
#5 0x00007f8875ea9ec1 in php_load_zend_extension_cb (arg=<optimized out>)
at /bld/php80/main/php_ini.c:391
#6 0x00007f8875ef80ee in zend_llist_apply (l=l@entry=0x7f8876443f60 <extension_lists>,
func=func@entry=0x7f8875ea9e30 <php_load_zend_extension_cb>)
at /bld/php80/Zend/zend_llist.c:182
#7 0x00007f8875eaaa47 in php_ini_register_extensions ()
at /bld/php80/main/php_ini.c:756
#8 0x00007f8875ea3a46 in php_module_startup (sf=<optimized out>,
additional_modules=additional_modules@entry=0x0,
num_additional_modules=num_additional_modules@entry=0)
at /bld/php80/main/main.c:2235
#9 0x0000000000404b6d in php_cli_startup (sapi_module=<optimized out>)
at /bld/php80/sapi/cli/php_cli.c:407
#10 0x000000000040453c in main (argc=6, argv=0x1ef3700)
at /bld/php80/sapi/cli/php_cli.c:1304
Previous Comments:
------------------------------------------------------------------------
[2020-10-20 15:32:09] nikic@php.net
Thank you for the investigation, this is rather intriguing. I find is hard to believe that this is
an allocator bug (I don't think I've seen one of those in years), it's more likely
that something is corrupting the allocator state.
There's two simple things that could be tried:
1. Run "USE_ZEND_ALLOC=0 php". That will switch to using the system allocator -- which
will possibly make it work, or crash harder...
2. Run "USE_ZEND_ALLOC=0 valgrind php", which might point out memory corruption. (In this
case, "USE_ZEND_ALLOC=1 valgrind php" might also be interesting.)
------------------------------------------------------------------------
[2020-10-20 15:00:49] brainpower at mailbox dot org
I've stepped through dasm_setupglobal, too, and added that to the gist.
At the end of that function, after the "realloc", D and D->lglabels are the same.
So maybe not a Bug in JIT but in the allocation function?
Please let me know if you need more information.
------------------------------------------------------------------------
[2020-10-20 14:51:42] brainpower at mailbox dot org
Found it: https://gist.github.com/brainpower/d85cc63d6820dd2fb65d12ca52f5f957#file-gistfile2-txt-L19
I've stepped through another time, since I thought the parameters to the memset may be
important.
Well D->lglabels points to the same address as D, so the memset overwrites D, obviously.
(Lines 19 and 23 of gistfile2.txt)
D->lglabels is touched only in dasm_setupglobal() before dasm_setup() is called, as far as I can
see.
------------------------------------------------------------------------
[2020-10-20 14:24:50] brainpower at mailbox dot org
https://gist.github.com/brainpower/d85cc63d6820dd2fb65d12ca52f5f957
Here's stepping through dasm_setup() up to the point where D->section is broken.
As I thought, it seems something is wrong with the memsets in there...
I've added the configure command to the gist, too.
Maybe some feature I've enabled messes with things.
------------------------------------------------------------------------
[2020-10-20 14:10:23] nikic@php.net
Would it be possible for you to set a break point on dasm_setup, step through it, and check that
D->section is initialized at the end?
In the meantime, I've done a php-8.0.0RC2 build on CentOS 7 (rather than Ubuntu 20.04) and
wasn't able to reproduce the issue there either.
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=80243
--
Edit this bug report at https://bugs.php.net/bug.php?id=80243&edit=1