[php-src] PR #23676: ext/opcache: inheritance cache entry published before ZCSG(map_ptr_la…
| From: | devnexen | Date: | Sat, 12 Sep 2026 13:53:32 +0000 |
| Subject: | [php-src] PR #23676: ext/opcache: inheritance cache entry published before ZCSG(map_ptr_la… | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38461@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23676
Author: devnexen
…st).
Fix #23637
zend_accel_inheritance_cache_add() linked the new entry into proto->inheritance_cache before
updating ZCSG(map_ptr_last), so another process could take that entry in
zend_accel_inheritance_cache_get(), extend its map_ptr table only up to the previous value, and
cache a class whose methods' run_time_cache offsets sit past its own CG(map_ptr_last). Calling
such a method read an uninitialised slot, kept by
zend_init_func_run_time_cache() as it is not NULL, which an fcall observer then dereferenced. The
entry is now published last.
The store order alone does not hold on weakly ordered architectures, hence the fences. The acquire
sits right after ce->inheritance_cache is read, not before the ZCSG(map_ptr_last) test: it pairs
with the release only when sequenced after the load reading the published pointer, and it also has
to cover the entry walk in zend_accel_inheritance_cache_find().