[php-src] PR #25224: Fix GH-25220: Clear leftover func_info after JIT setup failure
| From: | rafamolina1 | Date: | Thu, 05 Nov 2026 20:43:19 +0000 |
| Subject: | [php-src] PR #25224: Fix GH-25220: Clear leftover func_info after JIT setup failure | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40336@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25224
Author: rafamolina1
## Summary
-
zend_jit_script() builds the call graph in CG(arena) and stores those
func_info pointers on every op_array. For delayed JIT triggers (hot counters,
first-exec, etc.) it then allocates jit_extension from shared memory, which
zend_accel_script_persist_calc() does not reserve.
- If that allocation fails part-way through the op_arrays, jit_failure released the
arena without clearing the remaining FUNC_INFO slots. A later hot compile of a
successfully-setup function then reads a callee's stale func_info and segfaults in
type inference or zend_jit_cleanup_func_info().
- Clear FUNC_INFO from the failed index onward on the non-SCRIPT_LOAD
failure path so leftover op_arrays no longer point into the freed arena.
Fixes GH-25220
## Test plan
- [x] Compact reproducer (opcache.jit=1235, 8M SHM, 150 classes of 50 methods)
segfaults on unpatched PHP 8.5.4 (rc=139)
- [x] Same reproducer completes on patched PHP 8.4.27
- [x] make test TESTS=ext/opcache/tests/jit/gh25220.phpt PASSes on the patched build