Crashing tests on Windows x64

Description

As of 4dc7795, a couple of tests are crashing. (Note that the issues have no introduced by this commit, but are merely visible now.)

=====================================================================
FAILED TEST SUMMARY
---------------------------------------------------------------------
Bug #54268 (Double free when destroy_zend_class fails) [D:\a\php-src\php-src\Zend\tests\bug54268.phpt]
GH-9407: LSP error in eval'd code refers to wrong class for static type [D:\a\php-src\php-src\Zend\tests\gh9407.phpt]
Stack limit 014 - Fuzzer [D:\a\php-src\php-src\Zend\tests\stack_limit\stack_limit_014.phpt]
GH-14639 (Member access within null pointer in ext/spl/spl_observer.c) [D:\a\php-src\php-src\ext\spl\tests\gh14639.phpt]
Bug #45392 (ob_start()/ob_end_clean() and memory_limit) [D:\a\php-src\php-src\tests\lang\bug45392.phpt]
=====================================================================

4 of these test fail with status code FFFFFFFFC00000FF, which is ERROR_EA_LIST_INCONSISTENT, while one fails with FFFFFFFFC0000028, which is ERROR_OUT_OF_PAPER (these errors don't make much sense, but the German translation of ERROR_OUT_OF_PAPER even less: "Der Drucker ist aus Papier.")

Anyhow, this appears to be a tracing JIT issue.

PHP Version

master

Operating System

Windows

Oops, apparently looked up the wrong error codes: FFFFFFFFC0000028 is STATUS_BAD_STACK and FFFFFFFFC00000FF is STATUS_BAD_FUNCTION_TABLE. Makes more sense.

Note that locally I can only reproduce the crashes of Zend\tests\gh9407.phpt and tests\lang\bug45392.phpt, and both fail with STATUS_BAD_STACK, but only with tracing JIT enabled. gh9407.phpt fails on the LONGJMP() in _zend_bailout().

#14919 (comment) seems to be related.

PS: indeed, the tests are only failing when built with Visual Studio 2022 on x64 (but not on x86, and not when built with Visual Studio 2019). There might be an issue with vs17, or maybe just more thorough checking.

Dynamically xfail test cases which fail on CI

Der Drucker ist aus Papier.

Lol. That sounds like it would be a problem.

Dynamically xfail test cases which fail on CI (GH-15710)

If/when this issue is fixed 6d59620 should be reverted.

Fix gh16508.phpt test expectation

‎Zend/tests/gh16508.phpt has the same issue (STATUS_BAD_FUNCTION_TABLE). I cannot reproduce locally like for the other STATUS_BAD_FUNCTION_TABLE tests. I can only reproduce STATUS_BAD_STACK issues. I'll have a closer look.

Dynamically xfail test case which fails on CI

I've experimented with this locally, focusing on the Zend/tests/gh9407.phpt, since I can reproduce the STATUS_BAD_STACK reliably with x64/vs17 ZTS builds on master. I cannot, however, reproduce with x86 builds, nor NTS builds. nor with vs16, nor with vs17 builds of PHP-8.3. I also cannot reproduce if running gh9407.php. I've also did some experiments with CI. Some findings:

On Windows (at least x64), longjmp() normally calls RtlUnwindEx() to unwind the stack frame by frame, rather than jumping directly to the address directly. There is a hack to work around that, and this made gh9407.phpt pass locally, but on CI it triggered lots of STATUS_FAIL_FAST_EXCEPTIONs (which I haven't been able to reproduce locally). Anyhow, circumventing RtlUnwindEx() would unlikely be a proper solution, since it would not call C++ destructors.
At least with vs17, setjmp() calls __intrinsic_setjmp (what might explain that there are no issues with vs16; I haven't checked what vs16 compiles, though)
Perhaps the stack backtrace at Update Windows CI to build with vs17 #14919 (comment) gives a hint; why does it start with zend_jit_trace_hot_root()? Maybe we need to have a look at https://learn.microsoft.com/en-us/cpp/build/exception-handling-x64.

PS: the issue apparently does not occur if ZEND_DEBUG=1, and is likely somewhat related to ASan builds on Windows.

reproduced the failure with Release_TS build (Debug_TS works fine despite of the same generated code).

The relevant difference is the optimization level (/Ox for release, /Od for debug builds). If I do a release build with /Od (see diff below), the STATUS_BAD_STACK is gone.

diff

 win32/build/confutils.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/win32/build/confutils.js b/win32/build/confutils.js
index e847417bc7..6e7b6db031 100644
--- a/win32/build/confutils.js
+++ b/win32/build/confutils.js
@@ -3446,7 +3446,7 @@ function toolset_setup_build_mode()
 			ADD_FLAG("CFLAGS", "/Od /D NDebug /D NDEBUG /D ZEND_WIN32_NEVER_INLINE /D ZEND_DEBUG=0");
 		} else {
 			// Equivalent to Release_TSInline build -> best optimization
-			ADD_FLAG("CFLAGS", "/Ox /D NDebug /D NDEBUG /GF /D ZEND_DEBUG=0");
+			ADD_FLAG("CFLAGS", "/Od /D NDebug /D NDEBUG /GF /D ZEND_DEBUG=0");
 		}
 
 		// if you have VS.Net /GS hardens the binary against buffer overruns

@cmb69

@cmb69

The relevant difference is the optimization level (/Ox for release, /Od for debug builds).

Fyi, I build with /O2 /Ob3 see. https://github.com/nono303/win-build-scripts/blob/master/modules/phpsdk-config_make.bat#L175

@dstogov

Can you provide a patch that adds /SAFESEH:NO (just post it here).

diff --git "a/win32/build/confutils.js" "b/win32/build/confutils.js"
index 1a4ddbffaa..87bc57f6a2 100644
--- "a/win32/build/confutils.js"
+++ "b/win32/build/confutils.js"
@@ -3442,7 +3442,7 @@ function toolset_setup_build_mode()
 		// Generate external debug files when --enable-debug-pack is specified
 		if (PHP_DEBUG_PACK == "yes") {
 			ADD_FLAG("CFLAGS", "/Zi");
-			ADD_FLAG("LDFLAGS", "/incremental:no /debug /opt:ref,icf");
+			ADD_FLAG("LDFLAGS", "/incremental:no /safeseh:no /debug /opt:ref,icf");
 		}
 		ADD_FLAG("CFLAGS", "/LD /MD");
 		if (PHP_SANITIZER == "yes" && CLANG_TOOLSET) {

xfail STATUS_BAD_FUNCTION_TABLE tests

Fix GH-15709: Crashing tests on Windows x64 (#17095)

Merge branch 'PHP-8.4'

https://github.com/php/php-src/issues/15709#issuecomment-2522477075

Navigation Menu

Repository navigation

Crashing tests on Windows x64 #15709

Description

PHP Version

Operating System

17 remaining items

@cmb69

@dstogov

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Crashing tests on Windows x64 #15709

Description

Description

PHP Version

Operating System

Activity

cmb69 commented on Sep 2, 2024

cmb69 commented on Sep 2, 2024

iluuu1994 commented on Sep 2, 2024

Girgias commented on Sep 9, 2024

cmb69 commented on Oct 23, 2024

cmb69 commented on Oct 23, 2024

17 remaining items

cmb69 commented on Dec 6, 2024

nono303 commented on Dec 7, 2024

@cmb69

@dstogov

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions