Tracing JIT calls the wrong method for self::/parent:: static calls in trait methods shared by several classes
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
- 難度
- 4/5
- 預估耗時
- 3-5 天
- 新手友好度
- 48/100
- Issue 類型
- 缺陷
- 描述清晰度
- 描述清楚
- 活躍度
- 活躍
- 領域
- compilers, performance
研究方向
從 ext/opcache/jit/zend_jit_ir.c 開始，特別查看 zend_jit_init_static_method_call()，並比較 zend_jit_do_fcall() 和 zend_jit_trace.c 中相關的處理。執行 ext/opcache/tests/jit，然後使用提供的 tracing-JIT 命令執行 init_static_method_call_002.phpt；當 self:: 和 parent:: 呼叫產生預期的類別特定輸出且沒有回歸時，即表示完成。
由索引模型根據 Issue 內容生成。
描述
Description
With the tracing JIT, a trait method that calls self::x() or parent::x() is compiled with the callee resolved from the class that was executing when the trace was recorded. All classes using the trait share the same opcodes and therefore the same trace, but no callee guard is emitted when the resolved class is in the same file. The other classes then silently call the first class's method. No exception, no crash, just a wrong result.
<?php
class ParentA { public static function m() { return 'A'; } }
class ParentB { public static function m() { return 'B'; } }
trait T {
public function run(string $s) {
return parent::m() . $s;
}
}
class A extends ParentA { use T; }
class B extends ParentB { use T; }
$a = new A;
$b = new B;
$a->run('x');
$a->run('x');
$a->run('x');
echo $a->run('x'), "\n";
echo $b->run('y'), "\n";
echo $b->run('y'), "\n";
echo $a->run('x'), "\n";
php -d opcache.enable_cli=1 -d opcache.jit=tracing -d opcache.jit_buffer_size=16M \
-d opcache.jit_hot_func=2 -d opcache.jit_hot_loop=255 -d opcache.jit_hot_return=255 \
-d opcache.jit_hot_side_exit=255 test.php
Resulted in this output:
Ax
Ay
Ay
Ax
But I expected this output instead:
Ax
By
By
Ax
Without JIT and with opcache.jit=function the output is correct. The same happens with self:: (self::n() where A::n() and B::n() are declared in the using classes). The small hot counters only make it reproduce quickly; with defaults it happens once the trait method becomes hot.
The trace log (opcache.jit_debug=0x3F000) shows a single trace recorded for A::run() and no exit at all when B::run() executes:
---- TRACE 1 start (enter) A::run() test.php:6
---- TRACE 1 stop (return)
---- TRACE 1 compiled
Ax
Ay
Ay
Ax
Analysis
In zend_jit_init_static_method_call() (ext/opcache/jit/zend_jit_ir.c) the class for self::/parent:: comes from zend_get_known_class(), which uses op_array->scope. For a trait clone that is the scope of the recording class (here A), so func becomes ParentA::m. zend_jit_may_be_modified() then returns false because ParentA is declared in the same file, so no guard is emitted and ParentA::m is baked into the trace. B::run() reuses the trace through the shared opcodes.
The DO_FCALL side already handles this case (zend_jit_do_fcall(), "megamorphic call from trait"), and zend_jit_trace.c refuses to skip the guard for fake INIT calls of trait clones with a non-CONST class operand, but the INIT side of a recorded static call does not.
Dropping the static resolution for trait clones with a non-CONST class operand, right after zend_get_known_class(), makes the existing code emit the callee guard with a plain side exit, after which B::run() gets its own trace:
ce = zend_get_known_class(op_array, opline, opline->op1_type, opline->op1);
if ((op_array->fn_flags & ZEND_ACC_TRAIT_CLONE) && opline->op1_type != IS_CONST) {
ce = NULL; func = NULL; call_info = NULL; /* megamorphic call from trait */
}
With that change both variants produce the expected output on master, and ext/opcache/tests/jit passes (487/0 on master, macOS arm64). A phpt covering self:: and parent:: is ready (init_static_method_call_002.phpt); I can open a PR against PHP-8.5 if this approach is acceptable, or leave the fix to you if a polymorphic side trace is preferred.
The parent::-in-a-trait pattern is also the trigger for the 8.5 reports in #17626 (see #23571): there the guard is only emitted because a grandparent lives in another file, and it is the failure of that guard that reaches the bug fixed by #23571.
Disclaimer
The analysis and the suggested patch were produced with Claude Fable 5.1 (Anthropic) at my direction; I ran the reproductions and test runs on my machine and verified the results, but I cannot review the C myself.
PHP Version
PHP 8.5.10 (built from the php-8.5.10 tag) and master (1053403d). PHP 8.4.26-dev gives the correct output; the resolving code in zend_jit_init_static_method_call() exists since 8.5.
Operating System
macOS 15 (arm64); not OS specific.
- 主要語言
- C
- 星號
- 40.4k
- 分支
- 8.2k
- 平均合併
- 2 天 24 分鐘
- 30 天內合併 PR
- 157
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
php/php-src 的其他 Issue
-
難度 2/5 半天 新手友好度 62/100
維護者通常 1 天內回覆
-
Bug Status: Needs Triage
難度 2/5 1-3 小時 新手友好度 62/100
維護者通常 1 天內回覆
-
Feature Status: Needs Triage
難度 2/5 1-3 小時 新手友好度 73/100
維護者通常 1 天內回覆
-
Sockets from synchronous stream_socket_client() are left in non-blocking mode on Windows可能已有人在做 關聯的 PR 仍在進行中或已合併。 未關閉Bug Status: Needs Triage
難度 2/5 1-3 小時 新手友好度 66/100
維護者通常 1 天內回覆
-
sapi_lsapi_ub_write does not return bytes written in lsapi mode可能已有人在做 關聯的 PR 仍在進行中或已合併。 未關閉Bug Status: Needs Triage
難度 1/5 1 小時以內 新手友好度 90/100
維護者通常 1 天內回覆
相似的 Issue
-
area:runtime-vm
難度 2/5 1-3 小時 新手友好度 72/100
InauguralSystems/EigenScript#1748 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 62/100
維護者通常 4 天內回覆
-
難度 2/5 1-3 小時 新手友好度 85/100
維護者通常 1 天內回覆
-
foomatic-rip: dstrtrim_right() underflows mid-loop on an all-whitespace string可能已有人在做 @ManasBagul23 今天認領。 未關閉
難度 2/5 1-3 小時 新手友好度 82/100
OpenPrinting/cups-filters#759 ·
維護者通常 11 天內回覆
-
難度 2/5 1-3 小時 新手友好度 62/100
EchoTools/nevr-runtime#547 ·
維護者通常 1 天內回覆