Incorrect result when overwriting zend_write in JIT

[YuanchengJiang]

Description

The following code:

<?php
require_once('utils.inc');
$zend = FFI::cdef("
    typedef size_t (*zend_write_func_t)(const char *str, size_t str_length);
    extern zend_write_func_t zend_write;
", ffi_get_php_dll_name());
$orig_zend_write = clone $zend->zend_write;
$zend->zend_write = function($str, $len) {
    global $orig_zend_write;
    $orig_zend_write("{\n\t", 3);
    $ret = $orig_zend_write($str, $len);
    $orig_zend_write("}\n", 2);
    return $ret;
};
echo "test\n";
?>

Resulted in this output:

test

But I expected this output instead:

{
	test
}

To reproduce:

-d "zend_extension=/php-src/modules/opcache.so" -d "opcache.enable=1" -d "opcache.enable_cli=1" -d "opcache.jit=1205"

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

[nielsdos]

The issue here is that when the code is JITted, the zend_write pointer is read and a direct call is inserted by the JIT:

php-src/ext/opcache/jit/zend_jit_ir.c

Lines 11456 to 11457 in 8953348

	ir_CALL_2(IR_VOID, ir_CONST_FUNC(zend_write),
	ir_CONST_ADDR(str), ir_CONST_ADDR(len));

It's possible to fix this by always dereferencing the pointer, or by adding a guard. But this feels like such an artificial issue and the performance penalty is not worth it I think. I prefer not to fix this to be honest. cc @dstogov

[dstogov]

I also don't like to fix this.
It's possible to do a lot of unexpected weird things (using FFI or extensions) and we don't have to support them.

[bwoebi]

Yes, there are many pointers which we assume invariant after MINIT.
I don't even consider this a bug, but disrespect of invariants.

[nielsdos]

Agreed. I'll close this as invalid then.