[php-src] PR #24717: Fix JIT fuzzers never enabling the JIT

From: Date: Mon, 26 Oct 2026 06:01:35 +0000
Subject: [php-src] PR #24717: Fix JIT fuzzers never enabling the JIT
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-39890@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/24717 Author: yumasansansan The php-fuzz-function-jit and php-fuzz-tracing-jit fuzzers switch opcache.jit at runtime (off for the first run, then function / tracing). Since c16ad918ba3 (RFC [jit_config_defaults](https://wiki.php.net/rfc/jit_config_defaults), PHP 8.4) the default is opcache.jit=disable, which leaves JIT_G(enabled) = 0, and zend_jit_config() then refuses runtime changes with "Cannot change opcache.jit setting at run-time (JIT is disabled)". The fuzzers ignore the return value of zend_alter_ini_entry_chars(), so the JIT has not been exercised by these fuzzers since PHP 8.4. Evidence: - gdb on the current master: zend_jit_config("function", ZEND_INI_STAGE_RUNTIME) is entered with JIT_G(enabled) == 0, and zend_jit_script() / zend_jit_op_array() are never called. With this patch they are. - OSS-Fuzz coverage report (2026-10-24): ext/opcache/jit/ has 0.04% line coverage (40/103166 lines, 7/1407 functions), and the JIT fuzzers have lower total coverage than php-fuzz-execute. - Replaying the seed corpus generated from Zend/tests and ext/opcache/tests/jit (6181 files, one run each, ASan build): | Fuzzer | Before (cov / ft) | After (cov / ft) | |---|---|---| | php-fuzz-function-jit | 10664 / 17448 | 13472 / 28214 | | php-fuzz-tracing-jit | 10664 / 19061 | 14320 / 29350 | Before the patch both fuzzers reach exactly the same edges, as neither runs the JIT. The patch starts with opcache.jit=off (JIT available but off) and makes a failure to switch the JIT mode abort the fuzzer, so a future change of the defaults shows up as a crash on OSS-Fuzz instead of silently disabling JIT fuzzing. Note: once this lands, OSS-Fuzz will start exercising the JIT again after a gap of about three years, so a burst of new JIT reports is to be expected.

« previous php.git-pulls (#39890) next »