Skip to content

SEGV zend_jit_op_array_hot with property hooks and preloading #18898

Closed
Closed
SEGV zend_jit_op_array_hot with property hooks and preloading#18898
Assignees
ndossche
Labels
BugCategory: JITExtension: opcacheStatus: Verified

Description

@YuanchengJiang
YuanchengJiang
opened on Jun 22, 2025

Description

The following code:

<?php
$test = new DummyModel;
var_dump($test->dummyProperty2);

Resulted in this output:

/home/phpfuzz/WorkSpace/flowfusion/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:316:19: runtime error: member access within null pointer of type 'zend_jit_op_array_hot_extension' (aka 'struct _zend_jit_op_array_hot_extension')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:316:19 in

To reproduce:

./php-src/sapi/cli/php  -d "zend_extension=/home/phpfuzz/WorkSpace/flowfusion/php-src/modules/opcache.so" -d "opcache.enable_cli=1" -d "opcache.preload=/tmp/gh18534_preload.inc" -d "opcache.jit=1235" ./test.php

Commit:

be70f42de7c9ec0e6158ce9ec9d21f0dac24897f

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

This report is automatically generated by FlowFusion

PHP Version

be70f42de7c9ec0e6158ce9ec9d21f0dac24897f

Operating System

No response

Activity

  1. YuanchengJiang
    added
    Bug
    Status: Needs Triage
    on Jun 22, 2025
  2. devnexen
    added
    Category: JIT
    Extension: opcache
    Status: Verified
    and removed
    Status: Needs Triage
    on Jun 22, 2025

  3. ndossche commented on Jun 22, 2025

    @ndossche
    ndossche
    on Jun 22, 2025
    Member

    Duplicate of #18639

  4. ndossche
    marked this as a duplicate of Internal class aliases can break preloading + JIT #18639 on Jun 22, 2025
  5. ndossche
    closed this as duplicateon Jun 22, 2025
  6. ndossche
    added
    Status: Duplicate
    and removed
    Status: Verified
    on Jun 22, 2025

  7. YuanchengJiang commented on Jun 22, 2025

    @YuanchengJiang
    YuanchengJiang
    on Jun 22, 2025
    Author

    @nielsdos I worry this could be a variant. this loads gh18534_preload in 1235, while #18639 loads preload_gh18567 in 1255

    backtrace is different:

    /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:316:19: runtime error: member access within null pointer of type 'zend_jit_op_array_hot_extension' (aka 'struct _zend_jit_op_array_hot_extension')
    #0 0x7da05c069194 in zend_jit_func_counter_helper /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:316:19
    #1 0x4b5be93 in execute_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:58696:12
    #2 0x4aecf78 in zend_call_function /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_execute_API.c:1007:3
    #3 0x4af362e in zend_call_known_function /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_execute_API.c:1101:23
    #4 0x575dcb4 in zend_call_known_instance_method /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_API.h:865:2
    #5 0x571564b in zend_call_known_instance_method_with_0_params /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_API.h:871:2
    #6 0x572667b in zend_call_get_hook /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_object_handlers.c:725:2
    #7 0x571fe1d in zend_std_read_property /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_object_handlers.c:838:8
    #8 0x52b35ca in ZEND_FETCH_OBJ_R_SPEC_CV_CONST_INLINE_HANDLER /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:43187:12
    #9 0x4ee448c in ZEND_FETCH_OBJ_R_SPEC_CV_CONST_HANDLER /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:43216:2
    #10 0x4b5be93 in execute_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:58696:12
    #11 0x4b5e41c in zend_execute /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_vm_execute.h:64385:2
    #12 0x58d31a9 in zend_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend.c:1943:3
    #13 0x40c6b3a in php_execute_script_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2594:13
    #14 0x40c7c78 in php_execute_script /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2634:9
    #15 0x58e80ba in do_cli /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:952:5
    #16 0x58e249f in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1363:18
    #17 0x7da063501d8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #18 0x7da063501e3f in __libc_start_main csu/../csu/libc-start.c:392:3
    #19 0x6061a4 in _start (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6061a4)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/opcache/jit/zend_jit_vm_helpers.c:316:19 in

  8. ndossche commented on Jun 22, 2025

    @ndossche
    ndossche
    on Jun 22, 2025
    Member

    Thanks for getting back. I'm pretty sure all the preloading+JIT ones are related: they're all accessing the arena data from preloading in the non-preloaded execution. We have 2 other reports that are like this. But okay, I'll keep this open until all of those are resolved.

  9. ndossche
    reopened this on Jun 22, 2025

  10. ndossche commented on Jun 22, 2025

    @ndossche
    ndossche
    on Jun 22, 2025
    Member

    On first sight, the draft fix that I have for GH-14082 will also fix this one. I'll keep this open until my fix for GH-14082 went through review+gets merged and then I'll re-check.

  11. ndossche commented on Jun 23, 2025

    @ndossche
    ndossche
    on Jun 23, 2025
    Member

    Trying this on lower branches without hooks: it works, whereas without GH-14082's fix it doesn't.
    On 8.4+ it crashes when calling the hook. So there are two bugs here of which one is fixed and the other not yet...

  12. ndossche
    added
    Status: Verified
    and removed
    Status: Duplicate
    on Jun 23, 2025

  13. ndossche commented on Jun 23, 2025

    @ndossche
    ndossche
    on Jun 23, 2025
    Member

    The crash location is now also different:

    ==244590==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000000a0 (pc 0x000049c5037b bp 0x7ffcffcb8510 sp 0x7ffcffcb8280 T0)
==244590==The signal is caused by a READ memory access.
==244590==Hint: address points to the zero page.
    #0 0x000049c5037b  (/dev/zero (deleted)+0x800037b)
    #1 0x55d837f05618 in zend_call_function /run/media/niels/MoreData/php-8.4/Zend/zend_execute_API.c:1000
    #2 0x55d837f06631 in zend_call_known_function /run/media/niels/MoreData/php-8.4/Zend/zend_execute_API.c:1094
    #3 0x55d838197a38 in zend_call_known_instance_method /run/media/niels/MoreData/php-8.4/Zend/zend_API.h:860
    #4 0x55d838197a72 in zend_call_known_instance_method_with_0_params /run/media/niels/MoreData/php-8.4/Zend/zend_API.h:866
    #5 0x55d83819bd40 in zend_call_get_hook /run/media/niels/MoreData/php-8.4/Zend/zend_object_handlers.c:723
    #6 0x55d83819cc68 in zend_std_read_property /run/media/niels/MoreData/php-8.4/Zend/zend_object_handlers.c:837
    #7 0x55d83805394a in ZEND_FETCH_OBJ_R_SPEC_CV_CONST_INLINE_HANDLER /run/media/niels/MoreData/php-8.4/Zend/zend_vm_execute.h:43150
    #8 0x55d8380af7a8 in execute_ex /run/media/niels/MoreData/php-8.4/Zend/zend_vm_execute.h:63312
    #9 0x55d8380b3121 in zend_execute /run/media/niels/MoreData/php-8.4/Zend/zend_vm_execute.h:64308
    #10 0x55d8382166fc in zend_execute_script /run/media/niels/MoreData/php-8.4/Zend/zend.c:1934
    #11 0x55d837c654d6 in php_execute_script_ex /run/media/niels/MoreData/php-8.4/main/main.c:2575
    #12 0x55d837c658de in php_execute_script /run/media/niels/MoreData/php-8.4/main/main.c:2615
    #13 0x55d83821bfeb in do_cli /run/media/niels/MoreData/php-8.4/sapi/cli/php_cli.c:935
    #14 0x55d83821df15 in main /run/media/niels/MoreData/php-8.4/sapi/cli/php_cli.c:1310
    #15 0x7f937a0376b4  (/usr/lib/libc.so.6+0x276b4) (BuildId: 468e3585c794491a48ea75fceb9e4d6b1464fc35)
    #16 0x7f937a037768 in __libc_start_main (/usr/lib/libc.so.6+0x27768) (BuildId: 468e3585c794491a48ea75fceb9e4d6b1464fc35)
    #17 0x55d837005814 in _start (/run/media/niels/MoreData/php-8.4/sapi/cli/php+0x605814) (BuildId: ac11206fea3160206111b5c7c1170a5a76a943ad)
  14. ndossche
    self-assigned this
    on Jun 23, 2025
  15. ndossche
    changed the title [-]SEGV zend_jit_op_array_hot[/-] [+]SEGV zend_jit_op_array_hot with property hooks[/+] on Jun 23, 2025
  16. ndossche
    changed the title [-]SEGV zend_jit_op_array_hot with property hooks[/-] [+]SEGV zend_jit_op_array_hot with property hooks and preloading[/+] on Jun 23, 2025
  17. ndossche
    added a commit that references this issue on Jun 23, 2025

    Fix phpGH-18898: SEGV zend_jit_op_array_hot with property hooks and p…

    c9c7b07
  18. ndossche
    linked a pull request that will close this issueFix GH-18898: SEGV zend_jit_op_array_hot with property hooks and preloading #18923on Jun 23, 2025
  19. ndossche
    added a commit that references this issue on Jun 30, 2025

    Fix GH-18898: SEGV zend_jit_op_array_hot with property hooks and prel…

    53f2aa9
  20. ndossche
    closed this as completedin 53f2aa9on Jun 30, 2025
  21. ndossche
    added a commit that references this issue on Jun 30, 2025

    Merge branch 'PHP-8.4'

    4a98b36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

BugCategory: JITExtension: opcacheStatus: Verified

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions