[php-src] Issue #7817: JIT segmentation fault in PHP 8.1

Issue: https://github.com/php/php-src/issues/7817 Comment Author: meinemitternacht @cmb69 OK, here are my results: * opcache.jit = 0254 (fails) * opcache.jit = 1254 (fails) * opcache.jit = 0205 (passes) * opcache.jit = 1205 - (passes) The following is a partial backtrace output from gdb, obtained in a previous test. ```` 0 zend_fetch_ce_from_cache_slot (type=0x7f4f78c97170, cache_slot=0x8) at /usr/src/debug/php/8.1.1-r0/php-8.1.1/Zend/zend_execute.c:980 1 zend_check_type_slow (is_internal=false, is_return_type=false, cache_slot=0x8, ref=0x0, arg=0x7f4fb6e146f0, type=0x7f4f78c97170) at /usr/src/debug/php/8.1.1-r0/php-8.1.1/Zend/zend_execute.c:1043 2 zend_check_user_type_slow (type=0x7f4f78c97170, arg=0x7f4fb6e146f0, ref=0x0, cache_slot=0x8, is_return_type=false) at /usr/src/debug/php/8.1.1-r0/php-8.1.1/Zend/zend_execute.c:1103 ```` Debugging: opcache.jit = 1254 # 0b11111111111100000000 opcache.jit_debug = 1048320 ```` ZEND_JIT_DEBUG_ASM 0 ZEND_JIT_DEBUG_SSA 0 ZEND_JIT_DEBUG_REG_ALLOC 0 ZEND_JIT_DEBUG_ASM_STUBS 0 ZEND_JIT_DEBUG_PERF 0 ZEND_JIT_DEBUG_PERF_DUMP 0 ZEND_JIT_DEBUG_OPROFILE 0 ZEND_JIT_DEBUG_VTUNE 0 ZEND_JIT_DEBUG_GDB 1 ZEND_JIT_DEBUG_SIZE 1 ZEND_JIT_DEBUG_ASM_ADDR 1 ZEND_JIT_DEBUG_TRACE_START 1 ZEND_JIT_DEBUG_TRACE_STOP 1 ZEND_JIT_DEBUG_TRACE_COMPILED 1 ZEND_JIT_DEBUG_TRACE_EXIT 1 ZEND_JIT_DEBUG_TRACE_ABORT 1 ZEND_JIT_DEBUG_TRACE_BLACKLIST 1 ZEND_JIT_DEBUG_TRACE_BYTECODE 1 ZEND_JIT_DEBUG_TRACE_TSSA 1 ZEND_JIT_DEBUG_TRACE_EXIT_INFO 1 ```` This leads to the following debug output: ```` [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "---- TRACE 3 start (loop) FastRoute\DataGenerator\RegexBasedAbstract::buildRegexForRoute() /api/vendor/nikic/fast-route/src/DataGenerator/RegexBasedAbstract.php:130" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0004 FE_FETCH_R V6 CV3($part) 0050 ; op1(packed array) op2(string)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0005 INIT_NS_FCALL_BY_NAME 1 string("FastRoute\DataGenerator\is_string")" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: " >init is_string" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0006 SEND_VAR_EX CV3($part) 1 ; op1(packed array)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0007 V7 = DO_FCALL_BY_NAME" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: " >call is_string" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0008 JMPZ V7 0015 ; op1(bool)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0015 T7 = QM_ASSIGN CV3($part) ; op1(packed array)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0016 V8 = FETCH_LIST_R T7 int(0) ; op1(packed array) val(string)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0017 ASSIGN CV4($varName) V8 ; op1(string) op2(string)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0018 V8 = FETCH_LIST_R T7 int(1) ; op1(packed array) val(string)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0019 ASSIGN CV5($regexPart) V8 ; op1(string) op2(string)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0020 FREE T7 ; op1(packed array)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0021 T7 = ISSET_ISEMPTY_DIM_OBJ (isset) CV2($variables) CV4($varName) ; op1(array) op2(string) val(undef)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0022 ;JMPZ T7 0031" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0031 INIT_METHOD_CALL 1 THIS string("regexHasCapturingGroups")" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: " >init FastRoute\DataGenerator\RegexBasedAbstract::regexHasCapturingGroups" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0032 SEND_VAR CV5($regexPart) 1 ; op1(string)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0033 V7 = DO_FCALL" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: " >enter FastRoute\DataGenerator\RegexBasedAbstract::regexHasCapturingGroups" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0001 INIT_NS_FCALL_BY_NAME 2 string("FastRoute\DataGenerator\strpos")" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: " >init strpos" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0002 SEND_VAR_EX CV0($regex) 1 ; op1(string)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0003 SEND_VAL_EX string("(") 2" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0004 V2 = DO_FCALL_BY_NAME" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: " >call strpos" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0005 T1 = TYPE_CHECK (false) V2 ; op1(bool)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0006 ;JMPZ T1 0008" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0007 RETURN bool(false)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: " <back FastRoute\DataGenerator\RegexBasedAbstract::buildRegexForRoute" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0034 JMPZ V7 0044 ; op1(bool)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0044 ASSIGN_DIM CV2($variables) CV4($varName) ; op1(array) op2(string) op3(string) val(undef)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0045 ;OP_DATA CV4($varName)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0046 T8 = CONCAT string("(") CV5($regexPart) ; op2(string)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0047 T7 = FAST_CONCAT T8 string(")") ; op1(string)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0048 ASSIGN_OP (CONCAT) CV1($regex) T7 ; op1(string) op2(string)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "0049 JMP 0004" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "---- TRACE 3 stop (loop)" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: "---- TRACE 3 already prcessed" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: " TRACE 3 exit 2 FastRoute\DataGenerator\RegexBasedAbstract::buildRegexForRoute() /api/vendor/nikic/fast-route/src/DataGenerator/RegexBasedAbstract.php:130" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 said into stderr: " TRACE 3 exit 4 FastRoute\DataGenerator\RegexBasedAbstract::buildRegexForRoute() /api/vendor/nikic/fast-route/src/DataGenerator/RegexBasedAbstract.php:131" [27-Dec-2021 14:47:17] WARNING: [pool vtl] child 9433 exited on signal 11 (SIGSEGV) after 8.303799 seconds from start ```` So, it seems that some of the regex compilation in FastRoute is causing issues with the JIT, at least on my machine(s). Do you have any pointers on what debugging options or tests which would help move this issue forward?