Skip to content

assertion failure zend_jit_ir.c #18294

Closed
Closed
assertion failure zend_jit_ir.c#18294
Assignees
ndossche
Labels
BugCategory: JITExtension: opcacheStatus: Verified

Description

@YuanchengJiang
YuanchengJiang
opened on Apr 10, 2025

Description

The following code:

<?php
$a = [2147483647,2147483647,2147483647,3,0,0,32,2147483584,127];
echo @crc32(json_encode(bitwise_small_split($a))) . "\n";
function bitwise_small_split($val) {
$split = 8;
$len = count($val);
while ($i != $len) {
if (!$overflow) {
$overflow = $split <= $remaining ? 0 : $split - $remaining;
} elseif (++$i != $len) {
$fusion[$i] >>= $overflow;
}
}
}

Resulted in this output:

php: ext/opcache/jit/zend_jit_ir.c:1093: ir_ref jit_ZVAL_ADDR(zend_jit_ctx *, zend_jit_addr): Assertion `(((addr) & 0x3)) == 0' failed.
Aborted (core dumped)

To reproduce:

./php-src/sapi/cli/php  -d "opcache.jit_hot_func=1" -d "opcache.jit_hot_side_exit=1" -d "zend_extension=/home/phpfuzz/WorkSpace/flowfusion/php-src/modules/opcache.so" -d "opcache.enable_cli=1" -d "opcache.jit=1152" ./test.php

Commit:

787f26c8827baa4fa6ed554fa4562750cc86d1a6

Configurations:

CC="clang-12" CXX="clang++-12" CFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" CXXFLAGS="-DZEND_VERIFY_TYPE_INFERENCE" ./configure --enable-debug --enable-address-sanitizer --enable-undefined-sanitizer --enable-re2c-cgoto --enable-fpm --enable-litespeed --enable-phpdbg-debug --enable-zts --enable-bcmath --enable-calendar --enable-dba --enable-dl-test --enable-exif --enable-ftp --enable-gd --enable-gd-jis-conv --enable-mbstring --enable-pcntl --enable-shmop --enable-soap --enable-sockets --enable-sysvmsg --enable-zend-test --with-zlib --with-bz2 --with-curl --with-enchant --with-gettext --with-gmp --with-mhash --with-ldap --with-libedit --with-readline --with-snmp --with-sodium --with-xsl --with-zip --with-mysqli --with-pdo-mysql --with-pdo-pgsql --with-pgsql --with-sqlite3 --with-pdo-sqlite --with-webp --with-jpeg --with-freetype --enable-sigchild --with-readline --with-pcre-jit --with-iconv

Operating System:

Ubuntu 20.04 Host, Docker 0599jiangyc/flowfusion:latest

This report is automatically generated by FlowFusion

PHP Version

787f26c

Operating System

No response

Activity

  1. YuanchengJiang
    added
    Bug
    Status: Needs Triage
    on Apr 10, 2025
  2. devnexen
    added
    Category: JIT
    Extension: opcache
    Status: Verified
    and removed
    Status: Needs Triage
    on Apr 10, 2025

  3. ndossche commented on Apr 10, 2025

    @ndossche
    ndossche
    on Apr 10, 2025
    Member

    Can confirm:

    Program received signal SIGABRT, Aborted.
0x00007ffff6b3b624 in ?? () from /usr/lib/libc.so.6
(gdb) bt
#0  0x00007ffff6b3b624 in ?? () from /usr/lib/libc.so.6
#1  0x00007ffff6ae1ba0 in raise () from /usr/lib/libc.so.6
#2  0x00007ffff6ac9582 in abort () from /usr/lib/libc.so.6
#3  0x00007ffff6ac94eb in ?? () from /usr/lib/libc.so.6
#4  0x00007ffff08e17bf in jit_ZVAL_ADDR (jit=0x7ffff260d2a0, addr=10) at ext/opcache/jit/zend_jit_ir.c:1093
#5  0x00007ffff0932a62 in zend_jit_assign_dim_op (jit=0x7ffff260d2a0, opline=0x408d8a50, op1_info=3774871680, 
    op1_def_info=1627388032, op1_addr=41017, op2_info=16, op2_addr=34, op2_range=0x0, op1_data_info=16, 
    op3_addr=10, op1_data_range=0x0, dim_type=0 '\000', may_throw=1) at ext/opcache/jit/zend_jit_ir.c:13485
#6  0x00007ffff09b126a in zend_jit_trace (trace_buffer=0x7ffff2a30020, parent_trace=1, exit_num=2)
    at ext/opcache/jit/zend_jit_trace.c:4713
#7  0x00007ffff09fc1fe in zend_jit_compile_side_trace (trace_buffer=0x7ffff2a30020, parent_num=1, exit_num=2, 
    polymorphism=0) at ext/opcache/jit/zend_jit_trace.c:8251
#8  0x00007ffff09ff08d in zend_jit_trace_hot_side (execute_data=0x7ffff1007160, parent_num=1, exit_num=2)
    at ext/opcache/jit/zend_jit_trace.c:8496
#9  0x00007ffff0a03320 in zend_jit_trace_exit (exit_num=2, regs=0x7fffffffb240)
    at ext/opcache/jit/zend_jit_trace.c:8765
#10 0x0000000048000660 in ?? ()
#11 0x0000528000000100 in ?? ()
#12 0x0000000000000000 in ?? ()

    So the addr is a reg.

  4. ndossche
    self-assigned this
    on Apr 10, 2025

  5. ndossche commented on Apr 10, 2025

    @ndossche
    ndossche
    on Apr 10, 2025
    Member

    On first sight something like this should work, but need to double check:

    diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c
index 7ff6522ba2c..e9b1a9f01e1 100644
--- a/ext/opcache/jit/zend_jit_ir.c
+++ b/ext/opcache/jit/zend_jit_ir.c
@@ -13482,6 +13482,13 @@ static int zend_jit_assign_dim_op(zend_jit_ctx   *jit,
 					ref_path = ir_END();
 					ir_IF_TRUE_cold(if_typed);
 
+					if (Z_MODE(op3_addr) == IS_REG) {
+						zend_jit_addr real_addr = ZEND_ADDR_MEM_ZVAL(ZREG_FP, (opline+1)->op1.var);
+						if (!zend_jit_spill_store_inv(jit, op3_addr, real_addr, op1_data_info)) {
+							return 0;
+						}
+						op3_addr = real_addr;
+					}
 					arg2 = jit_ZVAL_ADDR(jit, op3_addr);
 					ir_CALL_3(IR_VOID, ir_CONST_FC_FUNC(zend_jit_assign_op_to_typed_ref),
 						reference, arg2, ir_CONST_FC_FUNC(binary_op));
  6. ndossche
    added a commit that references this issue on Apr 10, 2025

    Fix phpGH-18294: assertion failure zend_jit_ir.c

    eb7ff0e
  7. ndossche
    linked a pull request that will close this issueFix GH-18294: assertion failure zend_jit_ir.c #18299on Apr 10, 2025
  8. ndossche
    closed this as completedin 4a12a9fon Apr 11, 2025
  9. ndossche
    added 2 commits that reference this issue on Apr 11, 2025

    Merge branch 'PHP-8.4'

    e11a47f

    Fix GH-18294: assertion failure zend_jit_ir.c

    4a12a9f
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

BugCategory: JITExtension: opcacheStatus: Verified

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions