[php-src] PR #25399: Fix GH-17990: Tracing JIT uses the SSA of a dead process
| From: | kamil-tekiela | Date: | Wed, 11 Nov 2026 18:18:44 +0000 |
| Subject: | [php-src] PR #25399: Fix GH-17990: Tracing JIT uses the SSA of a dead process | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40554@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/25399
Author: kamil-tekiela
The tracing JIT stores the SSA of each function of a trace in the func_info of the op_array, which
is in shared memory. The SSA itself is in the arena of the compiling process, and zend_jit_trace()
resets the func_info when the compilation ends.
A process that dies during the compilation leaves the func_info behind. The next process that
compiles a trace through the same function finds a non-zero ssa->cfg.blocks_count and reads the
pointers of the dead process.
Reuse an SSA only if the current compilation built it, and block interruptions during the
compilation, as the rest of opcache does while it changes shared memory.
Fixes #17990 Can you check if this fixes the problem?