Applying non-zero offset 36 to null pointer in zend_jit.c

Description

Run the following test code(phpt):

--TEST--
Applying non-zero offset 36 to null pointer in zend_jit.c
--INI--
opcache.enable=1
opcache.enable_cli=1
opcache.jit=function
--FILE--
<?php
$root  = str_replace('.php', "", __FILE__);
$base  = basename( $root );
include "php_cli_server.inc";
?>
--EXTENSIONS--
opcache
--CONFLICTS--
server
--EXPECT--

php_cli_server.inc: https://github.com/php/php-src/blob/master/ext/opcache/tests/php_cli_server.inc

Resulted in this output:

/php-src/ext/opcache/jit/zend_jit.c:2619:60: runtime error: applying non-zero offset 36 to null pointer
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/ext/opcache/jit/zend_jit.c:2619:60 in

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

I can't reproduce this issue either. Can you please share information about how you built this (i.e. configure options + compiler version used), and how you run this?
The failure would be when getting the OP_DATA info, which would hint at a memory corruption issue somewhere, yet Valgrind nor ASAN show anything on my system...

The following script can reproduce in my environment (with UBSan and ASan):

/php-src/sapi/cli/php  -n -c '/php-src/tmp-php.ini'   -d "opcache.cache_id=worker3" -d "output_handler=" -d "open_basedir=" -d "disable_functions=" -d "output_buffering=Off" -d "error_reporting=32767" -d "display_errors=1" -d "display_startup_errors=1" -d "log_errors=0" -d "html_errors=0" -d "track_errors=0" -d "report_memleaks=1" -d "report_zend_debug=0" -d "docref_root=" -d "docref_ext=.html" -d "error_prepend_string=" -d "error_append_string=" -d "auto_prepend_file=" -d "auto_append_file=" -d "ignore_repeated_errors=0" -d "precision=14" -d "serialize_precision=-1" -d "memory_limit=128M" -d "opcache.fast_shutdown=0" -d "opcache.file_update_protection=0" -d "opcache.revalidate_freq=0" -d "opcache.jit_hot_loop=1" -d "opcache.jit_hot_func=1" -d "opcache.jit_hot_return=1" -d "opcache.jit_hot_side_exit=1" -d "opcache.jit_max_root_traces=100000" -d "opcache.jit_max_side_traces=100000" -d "opcache.jit_max_exit_counters=100000" -d "opcache.protect_memory=1" -d "zend.assertions=1" -d "zend.exception_ignore_args=0" -d "zend.exception_string_param_max_len=15" -d "short_open_tag=0" -d "extension_dir=/php-src/modules/" -d "zend_extension=/php-src/modules/opcache.so" -d "session.auto_start=0" -d "opcache.enable=1" -d "opcache.enable_cli=1" -d "opcache.jit=function" -f "/php-src/tests/merged/test.php"  2>&1

Only trips Clang, GCC didn't warn here. So it's ssa_op that's NULL, and pointer arithmetic on that is indeed NULL...
The thing is that only one branch is actually possible to take, so we can just delay adding 1...

Fix phpGH-13834: Applying non-zero offset 36 to null pointer in zend_…

Fix GH-13834: Applying non-zero offset 36 to null pointer in zend_jit…

Fix more "Applying non-zero offset XX to null pointer" warnings (See G…

Navigation Menu

Repository navigation

Applying non-zero offset 36 to null pointer in zend_jit.c #13834

Description

PHP Version

Operating System

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Applying non-zero offset 36 to null pointer in zend_jit.c #13834

Description

Description

PHP Version

Operating System

Activity

ndossche commented on Mar 29, 2024

YuanchengJiang commented on Mar 30, 2024

ndossche commented on Mar 30, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions