Skip to content

Conversation

@pull
Copy link

@pull pull bot commented Dec 24, 2024

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.1)

Can you help keep this open source service alive? 💖 Please sponsor : )

devnexen and others added 7 commits December 24, 2024 06:43
This bug happens because of a nested `SHM_UNPROTECT()` sequence.
In particular:
```
unprotect memory at ext/opcache/ZendAccelerator.c:2127
protect memory at ext/opcache/ZendAccelerator.c:2160
unprotect memory at ext/opcache/ZendAccelerator.c:2164
unprotect memory at ext/opcache/jit/zend_jit_trace.c:7464
^^^ Nested
protect memory at ext/opcache/jit/zend_jit_trace.c:7591
^^^ Problem is here: it should not protect again due to the nested unprotect
protect memory at ext/opcache/ZendAccelerator.c:2191
^^^ This one should actually protect, not the previous one
```

The reason this nesting happen is because:
1. We try to include the script, this eventually calls `cache_script_in_shared_memory`
2. `zend_optimize_script` will eventually run SCCP as part of the DFA pass.
3. SCCP will try to replace constants, but can also run destructors when a partial array is destructed here:

https://github.com/php/php-src/blob/4e9cde758eadf30cc4d596d6398c2c34c64197b4/Zend/Optimizer/sccp.c#L2387-L2389

In this case, this destruction invokes the GC which invokes the tracing JIT,
leading to the nested unprotects.

This patch disables the GC to prevent invoking user code, as user code
is not supposed to run during the optimizer pipeline.

Closes GH-17249.

Co-authored-by: Dmitry Stogov <[email protected]>
* PHP-8.3:
  Fix GH-17246: GC during SCCP causes segfault
* PHP-8.4:
  Fix GH-17246: GC during SCCP causes segfault
* PHP-8.3:
  [ci skip] Make build command for program using embed portable
* PHP-8.4:
  [ci skip] Make build command for program using embed portable
@pull pull bot added the ⤵️ pull label Dec 24, 2024
@pull pull bot merged commit 48b37fe into wudi:master Dec 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants