[php-src] PR #23676: ext/opcache: inheritance cache entry published before ZCSG(map_ptr_la…

From: Date: Sat, 12 Sep 2026 13:53:32 +0000
Subject: [php-src] PR #23676: ext/opcache: inheritance cache entry published before ZCSG(map_ptr_la…
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-38461@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/23676 Author: devnexen …st). Fix #23637 zend_accel_inheritance_cache_add() linked the new entry into proto->inheritance_cache before updating ZCSG(map_ptr_last), so another process could take that entry in zend_accel_inheritance_cache_get(), extend its map_ptr table only up to the previous value, and cache a class whose methods' run_time_cache offsets sit past its own CG(map_ptr_last). Calling such a method read an uninitialised slot, kept by zend_init_func_run_time_cache() as it is not NULL, which an fcall observer then dereferenced. The entry is now published last. The store order alone does not hold on weakly ordered architectures, hence the fences. The acquire sits right after ce->inheritance_cache is read, not before the ZCSG(map_ptr_last) test: it pairs with the release only when sequenced after the load reading the published pointer, and it also has to cover the entry walk in zend_accel_inheritance_cache_find().

« previous php.git-pulls (#38461) next »