Repository navigation
[BUG] Property hooks + enabled JIT causes unexpected results (segfault for JIT function) #17376
Description
Description
Hello, I think I found some bugs here.
- take official docker image
- install opcache
- set opcache.ini config as:
[opcache]
opcache.enable=1
opcache.enable_cli=1
opcache.jit_buffer_size=100M
opcache.jit=1205
The following code:
<?php
declare(strict_types=1);
interface EntityManagerInterface {
public function persist(object $entity);
}
class EntityManager implements EntityManagerInterface {
public function persist(object $entity)
{
echo "Persisting entity: " . get_class($entity) . "\n";
}
}
abstract class AbstractDecorator implements EntityManagerInterface {
protected $wrapped;
public function persist(object $entity)
{
$this->wrapped->persist($entity);
}
}
class EntityManagerDecorator extends AbstractDecorator {
protected object $proxy;
protected $wrapped {
get {
if (!isset($this->proxy)) {
$this->proxy = ($this->factory)();
}
return $this->proxy;
}
}
public function __construct(private Closure $factory)
{
}
}
$em = new EntityManagerDecorator(static fn() => new EntityManager());
$a = new stdClass();
$em->persist($a);
$a1 = new stdClass();
$em->persist($a1);Case 1: SEGMENTATION FAULT
If run this code, then it will be crash on
$em->persist($a1);
Case 2: Fatal error (unexpected behaviour)
If remove in this code interface EntityManagerInterface and implements statements then it will be give fatal error:
Fatal error: Uncaught Error: Call to a member function persist() on null in /app/test.php:20
Stack trace:
#0 /app/test.php(42): AbstractDecorator->persist(Object(stdClass))
#1 {main}
thrown in /app/test.php on line 20
If disable opcache or use tracing mode it will be work as expected:
Persisting entity: stdClass
Persisting entity: stdClass
P.S. I tried test PHP 8.4.3RC1 - bugs also exists there.
PHP Version
PHP 8.4.2
Operating System
Alpine 3.21
Activity
ndossche commentedon Jan 6, 2025
Simplified:
ndossche commentedon Jan 6, 2025
Probably,
zend_get_known_property_infois wrong in zend_jit.c.ndossche commentedon Jan 6, 2025
We're returning property info for the property but not taking into account that the subclasses may make the property a hook. This causes the property to be read from the property table instead of executing the hook, giving the wrong result.
We already return
NULLinzend_get_known_property_infobecause function JIT doesn't support hooks.It's not possible I think to extend the
zend_get_known_property_infoto also returnNULLwhen the property may be a hook in the subclass because we don't know what classes may get loaded at runtime.Ideally this gets fixed by adding real property hook support in the function JIT. This doesn't seem super easy.
mrVrAlex commentedon Jan 7, 2025
It seems with tracing JIT
opcache.jit=onalso have bug:Just wrap code to the cycle:
I think after some iterations will trigger JIT tracing and hook for $wrapped will be return null
[-]Property hooks & JIT function causes segfault or unexpected results [/-][+][BUG] Property hooks & JIT causes unexpected results (segfault for JIT function)[/+][-][BUG] Property hooks & JIT causes unexpected results (segfault for JIT function)[/-][+][BUG] Property hooks + enabled JIT causes unexpected results (segfault for JIT function)[/+]ndossche commentedon Jan 7, 2025
That makes sense, conceptually it's still the same issue I described earlier: there is no real hook codegen support for the JIT. We detect hooks, but only on the parent classes, not the child classes, and then take the slow path. So when a child class uses a hook and the parent class doesn't, the code generated for the parent class mistakingly assumes there is no hook and that breaks things.
10 remaining items
Fix circumvented added hooks in JIT
iluuu1994 commentedon Feb 26, 2025
Thanks for the patience, we finally found a reasonable solution to this issue.