Repository navigation
Fix GH-24337: JIT segfault when decrementing a non-numeric string property #24342
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,105 @@ | ||
| --TEST-- | ||
| GH-24337 (JIT: segfault in zend_get_executed_lineno when decrementing a non-numeric string property) | ||
|
Member
There was a problem hiding this comment. Can you please extend the test to also test with a bool/array
Contributor
Author
There was a problem hiding this comment. Done in 45e4b98. The test now covers bool and array for both ++ and --. Before the fix, function JIT also reported the wrong line for all of these, including the array TypeError. |
||
| --INI-- | ||
| opcache.enable=1 | ||
| opcache.enable_cli=1 | ||
| opcache.file_update_protection=0 | ||
| opcache.jit_buffer_size=64M | ||
| opcache.jit=tracing | ||
| opcache.jit_hot_loop=2 | ||
| opcache.jit_hot_func=2 | ||
| opcache.jit_hot_return=2 | ||
| opcache.jit_hot_side_exit=1 | ||
| --EXTENSIONS-- | ||
| opcache | ||
| --FILE-- | ||
| <?php | ||
| set_error_handler(function ($errno, $errstr, $errfile, $errline) { | ||
| echo "$errstr on line $errline\n"; | ||
| }); | ||
| class Q { | ||
| public $pu = 0; | ||
| function run() { | ||
| for ($i = 0; $i < 2; $i++) { | ||
| $this->pu--; | ||
| } | ||
| } | ||
| function inc() { | ||
| for ($i = 0; $i < 2; $i++) { | ||
| $this->pu++; | ||
| } | ||
| } | ||
| } | ||
| class S extends Q { | ||
| public $pu = 'u'; | ||
| function run() { | ||
| parent::run(); | ||
| } | ||
| } | ||
| class B extends Q { | ||
| public $pu = true; | ||
| function run() { | ||
| parent::run(); | ||
| } | ||
| } | ||
| class A extends Q { | ||
| public $pu = []; | ||
| function run() { | ||
| parent::run(); | ||
| } | ||
| } | ||
| $objs = [new Q, new S, new B, new A]; | ||
| for ($k = 0; $k < 4; $k++) { | ||
| foreach ($objs as $o) { | ||
| try { | ||
| $o->run(); | ||
| } catch (TypeError $e) { | ||
| echo $e->getMessage(), " on line ", $e->getLine(), "\n"; | ||
| } | ||
| try { | ||
| $o->inc(); | ||
| } catch (TypeError $e) { | ||
| echo $e->getMessage(), " on line ", $e->getLine(), "\n"; | ||
| } | ||
| } | ||
| } | ||
| var_dump($objs[0]->pu, $objs[1]->pu, $objs[2]->pu, $objs[3]->pu); | ||
| ?> | ||
| --EXPECT-- | ||
| Decrement on non-numeric string has no effect and is deprecated on line 9 | ||
| Decrement on non-numeric string has no effect and is deprecated on line 9 | ||
| Decrement on type bool has no effect, this will change in the next major version of PHP on line 9 | ||
| Decrement on type bool has no effect, this will change in the next major version of PHP on line 9 | ||
| Increment on type bool has no effect, this will change in the next major version of PHP on line 14 | ||
| Increment on type bool has no effect, this will change in the next major version of PHP on line 14 | ||
| Cannot decrement array on line 9 | ||
| Cannot increment array on line 14 | ||
| Decrement on non-numeric string has no effect and is deprecated on line 9 | ||
| Decrement on non-numeric string has no effect and is deprecated on line 9 | ||
| Decrement on type bool has no effect, this will change in the next major version of PHP on line 9 | ||
| Decrement on type bool has no effect, this will change in the next major version of PHP on line 9 | ||
| Increment on type bool has no effect, this will change in the next major version of PHP on line 14 | ||
| Increment on type bool has no effect, this will change in the next major version of PHP on line 14 | ||
| Cannot decrement array on line 9 | ||
| Cannot increment array on line 14 | ||
| Decrement on non-numeric string has no effect and is deprecated on line 9 | ||
| Decrement on non-numeric string has no effect and is deprecated on line 9 | ||
| Decrement on type bool has no effect, this will change in the next major version of PHP on line 9 | ||
| Decrement on type bool has no effect, this will change in the next major version of PHP on line 9 | ||
| Increment on type bool has no effect, this will change in the next major version of PHP on line 14 | ||
| Increment on type bool has no effect, this will change in the next major version of PHP on line 14 | ||
| Cannot decrement array on line 9 | ||
| Cannot increment array on line 14 | ||
| Decrement on non-numeric string has no effect and is deprecated on line 9 | ||
| Decrement on non-numeric string has no effect and is deprecated on line 9 | ||
| Decrement on type bool has no effect, this will change in the next major version of PHP on line 9 | ||
| Decrement on type bool has no effect, this will change in the next major version of PHP on line 9 | ||
| Increment on type bool has no effect, this will change in the next major version of PHP on line 14 | ||
| Increment on type bool has no effect, this will change in the next major version of PHP on line 14 | ||
| Cannot decrement array on line 9 | ||
| Cannot increment array on line 14 | ||
| int(0) | ||
| string(2) "ac" | ||
| bool(true) | ||
| array(0) { | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think MAY_BE_NULL may be excluded too for increment opcodes, but this is rare so probably not worth it. What do you think?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It would be correct: increment_function() turns null into 1 without a notice, and zend_may_throw_ex() already leaves NULL out for PRE/POST_INC. But here var_info is either all of MAY_BE_ANY or the single type from the trace guard. So it only changes the code when the property is exactly null at trace time, and after one ++ it is an int and the guard exits. I left it out to keep the same mask as the CV path in zend_jit_inc_dec(). Happy to add it if you prefer.