JIT: fix vm_interrupt resumption in TAILCALL/CALL VMs (#24793)

In the CALL and TAILCALL VMs, opcode handlers called by function JIT
can return the next opline tagged with ZEND_VM_ENTER_BIT after invoking
a VM interrupt callback. Function JIT used that result directly as an
opcode pointer, causing invalid accesses when execution continued.

Author: morrisonlevi

NEWS

@@ -149,6 +149,10 @@ PHP                                                                        NEWS
   . Fixed JIT segfault on switch over a string reference holding a
     non-string value. (jorgsowa)
   . Fixed AArch64 JIT encoding of invalid logical immediates. (jorgsowa)
+  . Fixed JIT crashes when handling a VM interrupt with a stale saved opline
+    in the tailcall VM. (Levi Morrison)
+  . Fixed function JIT misinterpreting VM-enter results after an interrupt
+    callback in the CALL and TAILCALL VMs. (Levi Morrison)
 
 - PDO:
   . Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated.

Zend/zend_vm_execute.h

@@ -2045,7 +2045,7 @@ function gen_executor($f, $skl, $spec, $kind, $executor_name, $initializer_name)
                             out($f,"# define ZEND_VM_ENTER()           execute_data = EG(current_execute_data); LOAD_OPLINE(); ZEND_VM_ENTER_EX()\n");
                             out($f,"# define ZEND_VM_LEAVE()           return (zend_op*)((uintptr_t)opline | ZEND_VM_ENTER_BIT)\n");
                             out($f,"#endif\n");
-                            out($f,"#define ZEND_VM_INTERRUPT()      ZEND_VM_TAIL_CALL(zend_interrupt_helper".($spec?"_SPEC":"")."(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU));\n");
+                            out($f,"#define ZEND_VM_INTERRUPT()      ZEND_VM_KIND_TAILCALL_SAVE_OPLINE(); ZEND_VM_TAIL_CALL(zend_interrupt_helper".($spec?"_SPEC":"")."(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU));\n");
                             out($f,"#ifdef ZEND_VM_FP_GLOBAL_REG\n");
                             out($f,"#define ZEND_VM_LOOP_INTERRUPT() zend_interrupt_helper".($spec?"_SPEC":"")."(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);\n");
                             out($f,"#else\n");

Zend/zend_vm_gen.php

@@ -4165,10 +4165,16 @@ static int zend_jit_handler(zend_jit_ctx *jit, const zend_op *opline, int may_th
 	} else if (ZEND_VM_KIND == ZEND_VM_KIND_TAILCALL) {
 		zend_vm_opcode_handler_func_t handler = (zend_vm_opcode_handler_func_t)zend_get_opcode_handler_func(opline);
 		ir_ref ip = ir_CALL_2(IR_ADDR, ir_CONST_FC_FUNC(handler), jit_FP(jit), jit_IP(jit));
+		if (zend_interrupt_function) {
+			ip = ir_AND_A(ip, ir_CONST_ADDR(~ZEND_VM_ENTER_BIT));
+		}
 		jit_STORE_IP(jit, ip);
 	} else {
 		zend_vm_opcode_handler_t handler = opline->handler;
 		ir_ref ip = ir_CALL_2(IR_ADDR, ir_CONST_FC_FUNC(handler), jit_FP(jit), jit_IP(jit));
+		if (zend_interrupt_function) {
+			ip = ir_AND_A(ip, ir_CONST_ADDR(~ZEND_VM_ENTER_BIT));
+		}
 		jit_STORE_IP(jit, ip);
 	}
 	if (may_throw) {

ext/opcache/jit/zend_jit_ir.c

@@ -0,0 +1,25 @@
+--TEST--
+Function JIT: decode the VM-enter bit after an interrupt callback
+--EXTENSIONS--
+opcache
+zend_test
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit=1201
+opcache.jit_buffer_size=64M
+zend_test.observer.set_vm_interrupt_on_begin=1
+--FILE--
+<?php
+function compare($left, $right) {
+    if ($left == $right) {
+        return 11;
+    }
+    return 22;
+}
+
+var_dump(compare(new VmInterruptComparable(1), new VmInterruptComparable(2)));
+?>
+--EXPECT--
+int(22)

ext/opcache/tests/jit/function_vm_interrupt_enter_001.phpt

@@ -0,0 +1,39 @@
+--TEST--
+Tracing JIT: preserve the next opline when handling a VM interrupt
+--DESCRIPTION--
+The object comparison raises an interrupt; the observer INI setting installs
+an interrupt callback without enabling observer events. While recording the
+caller, the backward jump must save its target before the interrupt helper
+reloads the opline. Otherwise it revisits the already executed call opcode,
+whose pending call frame has been consumed.
+
+At the time of writing this was failing on the TAILCALL VM, but this should
+pass on all VMs.
+--EXTENSIONS--
+opcache
+zend_test
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit=tracing
+opcache.jit_buffer_size=64M
+opcache.jit_hot_func=1
+opcache.jit_hot_loop=1
+zend_test.observer.set_vm_interrupt_on_begin=1
+--FILE--
+<?php
+function trigger(VmInterruptComparable $left, VmInterruptComparable $right): void {
+    // Raise an interrupt without an internal call that would handle it immediately.
+    $result = $left == $right;
+}
+
+$left = new VmInterruptComparable(1);
+$right = new VmInterruptComparable(2);
+foreach ([1, 2, 3] as $i) {
+    trigger($left, $right);
+}
+echo "Done\n";
+?>
+--EXPECT--
+Done

ext/opcache/tests/jit/tailcall_vm_interrupt_opline_001.phpt

@@ -0,0 +1,29 @@
+--TEST--
+Function JIT: preserve the next opline when handling a VM interrupt
+--DESCRIPTION--
+The object comparison raises an interrupt while the minimal function JIT
+executes a callable opcode handler. The interrupt helper must resume at the
+branch target, not reload the saved comparison opcode. No interrupt callback
+is installed, isolating the saved-opline bug from callback resume-tag handling.
+--EXTENSIONS--
+opcache
+zend_test
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit=1201
+opcache.jit_buffer_size=64M
+--FILE--
+<?php
+function compare($left, $right) {
+    if ($left == $right) {
+        return 11;
+    }
+    return 22;
+}
+
+var_dump(compare(new VmInterruptComparable(1), new VmInterruptComparable(2)));
+?>
+--EXPECT--
+int(22)