Bug #80426 [Com]: Crash when using JIT and an extension replacing zend_execute_ex with custom
Edit report at https://bugs.php.net/bug.php?id=80426&edit=1
ID: 80426
Comment by: patrickallaert@php.net
Reported by: patrickallaert@php.net
Summary: Crash when using JIT and an extension replacing
zend_execute_ex with custom
Status: Open
Type: Bug
Package: JIT
Operating System: Linux
PHP Version: 8.0.0
Block user comment: N
Private report: N
New Comment:
If the assertion is removed from php's source, it segfault with:
Program received signal SIGSEGV, Segmentation fault.
zval_undefined_cv (var=80) at /home/patrick.allaert/Projets/php-src/Zend/zend_execute.c:270
270 zend_string *cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
(gdb) bt
#0 zval_undefined_cv (var=80) at /home/patrick.allaert/Projets/php-src/Zend/zend_execute.c:270
#1 0x0000555555cf0d59 in _zval_undefined_op1 () at
/home/patrick.allaert/Projets/php-src/Zend/zend_execute.c:278
#2 0x0000555555d4f2b1 in zend_pre_inc_helper_SPEC_CV () at
/home/patrick.allaert/Projets/php-src/Zend/zend_vm_execute.h:37224
#3 0x0000555555d4f414 in ZEND_PRE_INC_SPEC_CV_RETVAL_UNUSED_HANDLER () at
/home/patrick.allaert/Projets/php-src/Zend/zend_vm_execute.h:37261
#4 0x0000555555d721f0 in execute_ex (ex=0x7ffff4e13020) at
/home/patrick.allaert/Projets/php-src/Zend/zend_vm_execute.h:57706
#5 0x00007ffff512c114 in custom_zend_execute (execute_data=0x7ffff4e13020) at
/home/patrick.allaert/Projets/extcrash/extcrash.c:11
#6 0x0000555555d734fe in zend_execute (op_array=0x7ffff4e5c280, return_value=0x0) at
/home/patrick.allaert/Projets/php-src/Zend/zend_vm_execute.h:58856
#7 0x0000555555cc756a in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/home/patrick.allaert/Projets/php-src/Zend/zend.c:1680
#8 0x0000555555c2a5d0 in php_execute_script (primary_file=0x7fffffffc280) at
/home/patrick.allaert/Projets/php-src/main/main.c:2488
#9 0x0000555555db3252 in do_cli (argc=7, argv=0x555556d94dd0) at
/home/patrick.allaert/Projets/php-src/sapi/cli/php_cli.c:949
#10 0x0000555555db4297 in main (argc=7, argv=0x555556d94dd0) at
/home/patrick.allaert/Projets/php-src/sapi/cli/php_cli.c:1336
Previous Comments:
------------------------------------------------------------------------
[2020-11-27 11:50:39] nikic@php.net
Test: https://github.com/php/php-src/pull/6461
------------------------------------------------------------------------
[2020-11-26 20:33:18] patrickallaert@php.net
Description:
------------
Using a minimal extension [1] that replaces zend_execute_ex with a decorator function and running in
cli with JIT enabled a simple PHP script [2] makes it crash.
[1] https://github.com/patrickallaert/extcrash
[2] https://github.com/patrickallaert/extcrash/blob/master/test.php
Test script:
---------------
See https://github.com/patrickallaert/extcrash.
Compile it and run the test.php script with:
php -d zend_extension=opcache -dopcache.enable_cli=1 -dopcache.jit_buffer_size=100M
-dextension=extcrash test.php
Expected result:
----------------
No crash
Actual result:
--------------
Crashes with the following info:
gdb /usr/local/php-8.0-debug/bin/php
(gdb) run -d zend_extension=opcache -dopcache.enable_cli=1 -dopcache.jit_buffer_size=100M
-dextension=extcrash test.php
Starting program: /usr/local/php-8.0-debug/bin/php -d zend_extension=opcache -dopcache.enable_cli=1
-dopcache.jit_buffer_size=100M -dextension=extcrash test.php
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
php: ext/opcache/jit/zend_jit_trace.c:7314: zend_jit_trace_exit: Assertion
`((execute_data)->opline) >= ((execute_data)->func)->op_array.opcodes &&
((execute_data)->opline) < ((execute_data)->func)->op_array.opcodes +
((execute_data)->func)->op_array.last' failed.
Program received signal SIGABRT, Aborted.
0x00007ffff757fa41 in raise () from /lib64/libc.so.6
(gdb) bt
#0 0x00007ffff757fa41 in raise () from /lib64/libc.so.6
#1 0x00007ffff7569536 in abort () from /lib64/libc.so.6
#2 0x00007ffff756941f in __assert_fail_base.cold () from /lib64/libc.so.6
#3 0x00007ffff7578332 in __assert_fail () from /lib64/libc.so.6
#4 0x00007ffff4fa30c6 in zend_jit_trace_exit (exit_num=3, regs=0x7fffffff9990) at
ext/opcache/jit/zend_jit_trace.c:7314
#5 0x000000004800049a in ?? ()
#6 0x00000000408d26a0 in ?? ()
#7 0x0000555556d7a6c8 in executor_globals ()
#8 0x00007ffff50022c8 in ?? ()
#9 0x0000555555c9e769 in _destroy_zend_class_traits_info (ce=0x408d26a0) at
/home/patrick.allaert/Projets/php-src/Zend/zend_opcode.c:256
#10 0xff00ffffffffffff in ?? ()
#11 0xffffffff000000ff in ?? ()
#12 0x0000000000000000 in ?? ()
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=80426&edit=1
Thread (5 messages)