Tracing JIT: segfault on $f($arr[k]) when $f alternates between by-value and by-reference functions
维护者通常 1 天内回复
还没有人认领这个 Issue。
- #24699 来自 @aasul —— 已关闭，未合并
评估
- 难度
- 4/5
- 预计耗时
- 1-2 天
- 新手友好度
- 48/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 领域
- backend, performance
调研方向
Start with zend_jit_trace.c and zend_jit_ir.c, following the reported INIT_DYNAMIC_CALL, FETCH_DIM_FUNC_ARG, and ZEND_SEND_FUNC_ARG paths; compare the DIM handling with the object fetch guard mentioned in the issue. Run the supplied reproducer with tracing JIT enabled and with JIT off to confirm the failure. Done means the JIT run exits normally while preserving the expected warnings.
由索引模型根据 Issue 内容生成。
描述
With the tracing JIT, a dynamic call $f($arr[k]) where $f alternates between a by-value and a by-reference function crashes.
<?php
function byval($a) { return (int)$a; }
function byref(&$a) { return (int)$a; }
$fns = ["byval", "byref"]; $arr = [];
for ($i = 0; $i < 120; $i++) { $f = $fns[$i % 2]; $f($arr[1]); $f($arr[0]); }
php -n -d opcache.enable=1 -d opcache.enable_cli=1 -d opcache.file_update_protection=0 -d opcache.jit_buffer_size=64M -d opcache.jit=tracing -d opcache.jit_hot_loop=1 -d opcache.jit_hot_func=1 -d opcache.jit_hot_return=1 -d opcache.jit_hot_side_exit=1 -d opcache.jit_max_polymorphic_calls=0 reduced.php
Debug build:
Warning: Undefined array key 1 in reduced.php on line 5
Warning: Undefined array key 0 in reduced.php on line 5
php: Zend/zend_operators.c:1016: zval_get_long_func: Assertion `0' failed.
Release build: the same two warnings, then SIGSEGV (exit 139).
With opcache.jit=off the script only prints the two warnings and exits normally, so I expected the same under the JIT. jit_max_polymorphic_calls=0 is not required: with the default value, a variant with five callees (four by-value, one by-ref) and a defined $arr = [5, 6] crashes the same way. The hot counters of 1 are needed to form the traces in a short script.
It reproduces at 9253b03bef3f7cb96ac2594c23382b0ba5ab6e19 (latest upstream when checked): the debug build hits the assertion above, the release build segfaults (rc 139).
Looks like the megamorphic INIT_DYNAMIC_CALL (call->func unknown) makes zend_jit_trace.c skip the specialised FETCH_DIM_FUNC_ARG, but zend_jit_send_var (zend_jit_ir.c, ZEND_SEND_FUNC_ARG) still compiles the by-ref branch using the recorded type of the fetched value, which does not include MAY_BE_INDIRECT. ZEND_FETCH_OBJ_FUNC_ARG has a zend_jit_func_arg_by_ref_guard for this case and the DIM variant does not. This is from reading jit_debug trace output, not confirmed in a debugger. Open PR #18392 (reworks EX(call) handling in the call/send path) may be related; I did not test it, its diff does not apply on the latest commit.
I can send a patch if that helps.
Found with an LLM-based testing tool; I used Claude to reduce it and look for the cause.
- 主要语言
- C
- 星标
- 40.7k
- 派生
- 8.3k
- 平均合并
- 2 天 20 小时
- 30 天内合并 PR
- 147
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
php/php-src 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
sapi/fpm/tests/tester.inc can send SIGUSR2 to pid 0, killing run-tests.php可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭Bug Status: Needs Triage
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
zend_set_local_var() overwrites existing compiled variable (CV) zval without calling zval_ptr_dtor()可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭Bug Status: Needs Triage
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
Case-insensitive substr_compare, ksort, krsort are still locale-dependent可能已有人在做 @lazerg 于 4 天前认领。 未关闭Bug Extension: standard Status: Verified
难度 2/5 1-3 小时 新手友好度 73/100
维护者通常 1 天内回复
相似的 Issue
-
dependency component: oneMKL module: dpclang
难度 2/5 1-3 小时 新手友好度 82/100
intel/torch-xpu-ops#5880 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 75/100
维护者通常 1 天内回复
-
CVE-2026-111497未关闭
难度 1/5 1 小时以内 新手友好度 82/100
fink/fink-distributions#1322 ·
-
难度 1/5 1 小时以内 新手友好度 83/100
openvehicles/Open-Vehicle-Monitoring-System-3#1563 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 65/100