[php-src] Issue #7817: JIT segmentation fault in PHP 8.1
| From: | meinemitternacht | Date: | Thu, 30 Dec 2021 18:41:37 +0000 |
| Subject: | [php-src] Issue #7817: JIT segmentation fault in PHP 8.1 | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-238662@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/7817
Comment Author: meinemitternacht
@dstogov I have GDB attached to a php-fpm process and reproduced the segfault.
~~~~
(gdb) bt
#0 zend_check_type_slow (is_internal=false, is_return_type=false, cache_slot=0x8, ref=0x0,
arg=0x7f6249014590, type=0x7f620af3d470)
at /usr/src/debug/php/8.1.1-r0/php-8.1.1/Zend/zend_execute.c:1043
#1 zend_check_user_type_slow (type=0x7f620af3d470, arg=0x7f6249014590, ref=0x0, cache_slot=0x8,
is_return_type=false)
at /usr/src/debug/php/8.1.1-r0/php-8.1.1/Zend/zend_execute.c:1103
#2 0x00007f6249289e9a in zend_jit_verify_arg_slow (arg=0x7f6249014590, arg_info=0x7f620af3d468) at
/usr/src/debug/php/8.1.1-r0/php-8.1.1/ext/opcache/jit/zend_jit_helpers.c:1467
#3 0x00007f6228cae736 in ?? ()
#4 0x00007f624907b240 in ?? ()
#5 0x00007f620af298d8 in ?? ()
#6 0x0000000000000000 in ?? ()
======
#2 0x00007f6249289e9a in zend_jit_verify_arg_slow (arg=0x7f6249014590, arg_info=0x7f620af3d468) at
/usr/src/debug/php/8.1.1-r0/php-8.1.1/ext/opcache/jit/zend_jit_helpers.c:1467
1467 in /usr/src/debug/php/8.1.1-r0/php-8.1.1/ext/opcache/jit/zend_jit_helpers.c
(gdb) info args
arg = 0x7f6249014590
arg_info = 0x7f620af3d468
======
(gdb) print *arg
$9 = {
value = {
lval = 140060108612160,
dval = 6.9198888018061968e-310,
counted = 0x7f6249056240,
str = 0x7f6249056240,
arr = 0x7f6249056240,
obj = 0x7f6249056240,
res = 0x7f6249056240,
ref = 0x7f6249056240,
ast = 0x7f6249056240,
zv = 0x7f6249056240,
ptr = 0x7f6249056240,
ce = 0x7f6249056240,
func = 0x7f6249056240,
ww = {
w1 = 1225089600,
w2 = 32610
}
},
u1 = {
type_info = 776,
v = {
type = 8 '\b',
type_flags = 3 '\003',
u = {
extra = 0
}
}
},
u2 = {
next = 0,
cache_slot = 0,
opline_num = 0,
lineno = 0,
num_args = 0,
fe_pos = 0,
fe_iter_idx = 0,
property_guard = 0,
constant_flags = 0,
extra = 0
}
}
======
(gdb) print *arg_info
$10 = {
name = 0x7f620950bd80,
type = {
ptr = 0x7f620950d350,
type_mask = 16777216
},
default_value = 0x6e6f6974696e00
}
======
(gdb) print *arg_info.name
$11 = {
gc = {
refcount = 2,
u = {
type_info = 342
}
},
h = 17469586239392435662,
len = 10,
val = "d"
}
~~~~
What is
*arg_info.name.val ? Is that the name of a PHP variable, or something internal
to the Zend engine or JIT?