[php-src] PR #25224: Fix GH-25220: Clear leftover func_info after JIT setup failure

From: Date: Thu, 05 Nov 2026 20:43:19 +0000
Subject: [php-src] PR #25224: Fix GH-25220: Clear leftover func_info after JIT setup failure
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-40336@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/25224 Author: rafamolina1 ## Summary - zend_jit_script() builds the call graph in CG(arena) and stores those func_info pointers on every op_array. For delayed JIT triggers (hot counters, first-exec, etc.) it then allocates jit_extension from shared memory, which zend_accel_script_persist_calc() does not reserve. - If that allocation fails part-way through the op_arrays, jit_failure released the arena without clearing the remaining FUNC_INFO slots. A later hot compile of a successfully-setup function then reads a callee's stale func_info and segfaults in type inference or zend_jit_cleanup_func_info(). - Clear FUNC_INFO from the failed index onward on the non-SCRIPT_LOAD failure path so leftover op_arrays no longer point into the freed arena. Fixes GH-25220 ## Test plan - [x] Compact reproducer (opcache.jit=1235, 8M SHM, 150 classes of 50 methods) segfaults on unpatched PHP 8.5.4 (rc=139) - [x] Same reproducer completes on patched PHP 8.4.27 - [x] make test TESTS=ext/opcache/tests/jit/gh25220.phpt PASSes on the patched build

« previous php.git-pulls (#40336) next »