[php-src] Issue #8030: Segfault with JIT and large match/switch statements
| From: | therealgaxbo | Date: | Thu, 03 Feb 2022 17:35:24 +0000 |
| Subject: | [php-src] Issue #8030: Segfault with JIT and large match/switch statements | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-239459@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/8030
Author: therealgaxbo
### Description
Running this code with the JIT enabled results in a segfault (sometimes I have to run it 2-3 times
before it happens): https://gist.github.com/therealgaxbo/5e7b111c994bf932e3e7870ac258babe
```
$ php -v
PHP 8.0.15 (cli) (built: Jan 18 2022 12:16:19) ( NTS gcc x86_64 )
Copyright (c) The PHP Group
Zend Engine v4.0.15, Copyright (c) Zend Technologies
with Zend OPcache v8.0.15, Copyright (c), by Zend Technologies
$ php -n -dzend_extension=/usr/lib64/php/modules/opcache.so -dopcache.enable_cli=1
-dopcache.jit_buffer_size=64M match.php
Segmentation fault (core dumped)
```
The same result happens with 8.1.2.
This is as minimal as I've managed to make the repro. It seems extremely sensitive to the
precise order that the two different match arms are accessed.
A similar segfault happens with an equivalent switch statement, although the exact number of arms
may need increasing.
### PHP Version
PHP 8.0.15, PHP 8.1.2
### Operating System
Fedora 35