Bug #81051 [Opn->Ver]: Broken property type handling after incrementing reference
Edit report at https://bugs.php.net/bug.php?id=81051&edit=1
ID: 81051
Updated by: nikic@php.net
Reported by: dktapps at pmmp dot io
Summary: Broken property type handling after incrementing
reference
-Status: Open
+Status: Verified
Type: Bug
Package: JIT
Operating System: Linux
PHP Version: 8.0.6
-Assigned To:
+Assigned To: dmitry
Block user comment: N
Private report: N
New Comment:
Still reproduces on master.
Previous Comments:
------------------------------------------------------------------------
[2021-05-19 13:34:00] dktapps at pmmp dot io
Description:
------------
When incrementing a typed property by-reference, it seems like the type gets broken, causing
spurious errors and assert failures.
This was discovered in debug mode using opcache.jit=1205.
In debug mode, the following assert is triggered:
(gdb) run php-8-jit-bugs/samples/by-ref-increment-typed-property.php
Starting program: /home/dktapps/pm-dev/bin/php7/bin/php
php-8-jit-bugs/samples/by-ref-increment-typed-property.php
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
int(0)
php: /home/dktapps/pm-dev/install_data/subdir/php/Zend/zend_execute.c:895:
i_zend_check_property_type: Assertion `!(zval_get_type(&(*(property))) == 10)' failed.
Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
51 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1 0x00007ffff47a3921 in __GI_abort () at abort.c:79
#2 0x00007ffff479348a in __assert_fail_base (fmt=0x7ffff491a750 "%s%s%s:%u: %s%sAssertion
`%s' failed.\n%n", assertion=assertion@entry=0x555556123548
"!(zval_get_type(&(*(property))) == 10)",
file=file@entry=0x555556123180
"/home/dktapps/pm-dev/install_data/subdir/php/Zend/zend_execute.c", line=line@entry=895,
function=function@entry=0x555556126200 <__PRETTY_FUNCTION__.15039>
"i_zend_check_property_type") at assert.c:92
#3 0x00007ffff4793502 in __GI___assert_fail (assertion=0x555556123548
"!(zval_get_type(&(*(property))) == 10)", file=0x555556123180
"/home/dktapps/pm-dev/install_data/subdir/php/Zend/zend_execute.c",
line=895, function=0x555556126200 <__PRETTY_FUNCTION__.15039>
"i_zend_check_property_type") at assert.c:101
#4 0x0000555555d984f5 in i_zend_check_property_type (info=0x408d3700, property=0x7ffff44020a8,
strict=false) at /home/dktapps/pm-dev/install_data/subdir/php/Zend/zend_execute.c:895
#5 0x0000555555d98615 in i_zend_verify_property_type (info=0x408d3700, property=0x7ffff44020a8,
strict=false) at /home/dktapps/pm-dev/install_data/subdir/php/Zend/zend_execute.c:915
#6 0x0000555555d98666 in zend_verify_property_type (info=0x408d3700, property=0x7ffff44020a8,
strict=false) at /home/dktapps/pm-dev/install_data/subdir/php/Zend/zend_execute.c:924
#7 0x00007ffff40d0e1d in zend_jit_post_inc_typed_prop (var_ptr=0x7ffff44020a8,
prop_info=0x408d3700, result=0x7ffff4414170) at ext/opcache/jit/zend_jit_helpers.c:2359
#8 0x0000000048001f0d in ?? ()
#9 0x00007ffff4402070 in ?? ()
#10 0x00007fff00000001 in ?? ()
#11 0x000000004024a860 in ?? ()
#12 0x00005555565987d0 in ?? ()
#13 0xfffffffffffffed6 in ?? ()
#14 0x000000004024b1a0 in ?? ()
#15 0x00007fffffffa3f0 in ?? ()
#16 0x0000555555d80417 in zend_hash_find_bucket (ht=0x0, key=0x0, known_hash=85) at
/home/dktapps/pm-dev/install_data/subdir/php/Zend/zend_hash.c:649
#17 0x0000555555e2324f in zend_execute (op_array=0x7ffff445d280, return_value=0x0) at
/home/dktapps/pm-dev/install_data/subdir/php/Zend/zend_vm_execute.h:58875
#18 0x0000555555d6b0a7 in zend_execute_scripts (type=8, retval=0x0, file_count=3) at
/home/dktapps/pm-dev/install_data/subdir/php/Zend/zend.c:1680
#19 0x0000555555cb0a87 in php_execute_script (primary_file=0x7fffffffcb50) at
/home/dktapps/pm-dev/install_data/subdir/php/main/main.c:2488
#20 0x0000555555e67c23 in do_cli (argc=2, argv=0x555556594020) at
/home/dktapps/pm-dev/install_data/subdir/php/sapi/cli/php_cli.c:949
#21 0x0000555555e68eb0 in main (argc=2, argv=0x555556594020) at
/home/dktapps/pm-dev/install_data/subdir/php/sapi/cli/php_cli.c:1336
Test script:
---------------
<?php
class Binary{
public static function readUnsignedVarInt(string $buffer, int &$offset) : int{
$offset++;
return 0;
}
}
class BinaryStream{
private string $buffer;
private int $offset;
public function __construct(string $buffer, int $offset = 0){
$this->buffer = $buffer;
$this->offset = $offset;
}
public function getUnsignedVarInt() : int{
return Binary::readUnsignedVarInt($this->buffer, $this->offset);
}
public function get(int $len) : string{
return $len === 1 ? $this->buffer[$this->offset++] : substr($this->buffer,
($this->offset += $len) - $len, $len);
}
}
$stream = new BinaryStream(str_repeat("\x01a", 1000));
var_dump($stream->getUnsignedVarInt());
var_dump($stream->get(1));
Expected result:
----------------
int(0)
string(1) "a"
Actual result:
--------------
In release mode:
```
int(0)
PHP Fatal error: Uncaught TypeError: Cannot assign int to property BinaryStream::$offset of type
int in
/home/runner/work/php-8-jit-bugs/php-8-jit-bugs/samples/by-ref-increment-typed-property.php:25
Stack trace:
#0 /home/runner/work/php-8-jit-bugs/php-8-jit-bugs/samples/by-ref-increment-typed-property.php(30):
BinaryStream->get()
#1 {main}
thrown in
/home/runner/work/php-8-jit-bugs/php-8-jit-bugs/samples/by-ref-increment-typed-property.php on line
25
```
In debug mode:
```
int(0)
php: /home/dktapps/pm-dev/install_data/subdir/php/Zend/zend_execute.c:895:
i_zend_check_property_type: Assertion `!(zval_get_type(&(*(property))) == 10)' failed.
Aborted (core dumped)
```
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=81051&edit=1
Thread (3 messages)