Bug #80243 [Com]: OPCache JIT segfaults at startup

Edit report at https://bugs.php.net/bug.php?id=80243&edit=1 ID: 80243 Comment by: brainpower at mailbox dot org Reported by: jens-erik dot riedel at kippdata dot de Summary: OPCache JIT segfaults at startup Status: Open Type: Bug Package: JIT Operating System: RHEL 8.0 PHP Version: 8.0.0rc1 Block user comment: N Private report: N New Comment: Yeah, same crash in php_ini.c for me... After a short look into that file, I think there is a return missing after line 377: 368 efree(orig_libpath); 369 efree(err1); 370 efree(libpath); 371 efree(err2); 372 return; 373 } 374 375 efree(orig_libpath); 376 efree(err1); 377 efree(libpath); >> RETURN MISSING HERE?? << 378 } 379 380 #ifdef PHP_WIN32 381 if (!php_win32_image_compatible(handle, &err1)) { .... 387 #endif 388 389 zend_load_extension_handle(handle, libpath); 390 efree(libpath); // theese lines should probably not be reached if(!handle) above is entered... 391 } Previous Comments: ------------------------------------------------------------------------ [2020-10-20 16:49:31] jens-erik dot riedel at kippdata dot de I have tried with USE_ZEND_ALLOC=0 (using 8.0.0rc1 on RHEL 8). It crashes again; I don't know if this qualifies as "crashes harder" but at least it crashes differently. $ USE_ZEND_ALLOC=0 /opt/products/php80/8.0.0rc1-1/bin/php -c /opt/instances/php80-fpm/lib/php.ini -d opcache.enable_cli=1 -i free(): double free detected in tcache 2 Aborted (core dumped) Backtrace is as follows: Core was generated by `/opt/products/php80/8.0.0rc1-1/bin/php -c /opt/instances/php80-fpm/lib/php.ini'. Program terminated with signal SIGABRT, Aborted. #0 0x00007f88746e893f in raise () from /lib64/libc.so.6 (gdb) bt #0 0x00007f88746e893f in raise () from /lib64/libc.so.6 #1 0x00007f88746d2c95 in abort () from /lib64/libc.so.6 #2 0x00007f887472bd57 in __libc_message () from /lib64/libc.so.6 #3 0x00007f887473268c in malloc_printerr () from /lib64/libc.so.6 #4 0x00007f8874734155 in _int_free () from /lib64/libc.so.6 #5 0x00007f8875ea9ec1 in php_load_zend_extension_cb (arg=<optimized out>) at /bld/php80/main/php_ini.c:391 #6 0x00007f8875ef80ee in zend_llist_apply (l=l@entry=0x7f8876443f60 <extension_lists>, func=func@entry=0x7f8875ea9e30 <php_load_zend_extension_cb>) at /bld/php80/Zend/zend_llist.c:182 #7 0x00007f8875eaaa47 in php_ini_register_extensions () at /bld/php80/main/php_ini.c:756 #8 0x00007f8875ea3a46 in php_module_startup (sf=<optimized out>, additional_modules=additional_modules@entry=0x0, num_additional_modules=num_additional_modules@entry=0) at /bld/php80/main/main.c:2235 #9 0x0000000000404b6d in php_cli_startup (sapi_module=<optimized out>) at /bld/php80/sapi/cli/php_cli.c:407 #10 0x000000000040453c in main (argc=6, argv=0x1ef3700) at /bld/php80/sapi/cli/php_cli.c:1304 ------------------------------------------------------------------------ [2020-10-20 15:32:09] nikic@php.net Thank you for the investigation, this is rather intriguing. I find is hard to believe that this is an allocator bug (I don't think I've seen one of those in years), it's more likely that something is corrupting the allocator state. There's two simple things that could be tried: 1. Run "USE_ZEND_ALLOC=0 php". That will switch to using the system allocator -- which will possibly make it work, or crash harder... 2. Run "USE_ZEND_ALLOC=0 valgrind php", which might point out memory corruption. (In this case, "USE_ZEND_ALLOC=1 valgrind php" might also be interesting.) ------------------------------------------------------------------------ [2020-10-20 15:00:49] brainpower at mailbox dot org I've stepped through dasm_setupglobal, too, and added that to the gist. At the end of that function, after the "realloc", D and D->lglabels are the same. So maybe not a Bug in JIT but in the allocation function? Please let me know if you need more information. ------------------------------------------------------------------------ [2020-10-20 14:51:42] brainpower at mailbox dot org Found it: https://gist.github.com/brainpower/d85cc63d6820dd2fb65d12ca52f5f957#file-gistfile2-txt-L19 I've stepped through another time, since I thought the parameters to the memset may be important. Well D->lglabels points to the same address as D, so the memset overwrites D, obviously. (Lines 19 and 23 of gistfile2.txt) D->lglabels is touched only in dasm_setupglobal() before dasm_setup() is called, as far as I can see. ------------------------------------------------------------------------ [2020-10-20 14:24:50] brainpower at mailbox dot org https://gist.github.com/brainpower/d85cc63d6820dd2fb65d12ca52f5f957 Here's stepping through dasm_setup() up to the point where D->section is broken. As I thought, it seems something is wrong with the memsets in there... I've added the configure command to the gist, too. Maybe some feature I've enabled messes with things. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=80243 -- Edit this bug report at https://bugs.php.net/bug.php?id=80243&edit=1