php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #80839 PHP problem with JIT
Submitted: 2021-03-06 00:21 UTC Modified: 2021-03-17 10:06 UTC
From: gfpuba+phpbug at gmail dot com Assigned: dmitry (profile)
Status: Closed Package: JIT
PHP Version: 8.0Git-2021-03-06 (Git) OS: Windows 10
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: gfpuba+phpbug at gmail dot com
New email:
PHP Version: OS:

 

 [2021-03-06 00:21 UTC] gfpuba+phpbug at gmail dot com
Description:
------------
Running this program results in invalid data.
May also causes PHP to crash.
Works fine without JIT.

The problem has been narrowed as best as I can.
The original problem was a PHP crash using JIT in a much larger application.

Fails the same in Apache 2.4 or CLI (both 64bits)

Test script:
---------------
<?php 
$a = null; // the problem only occurs when set to NULL
test($a, 'y');

function test($str, $pad) {
	$x = $str . str_repeat($pad, 15); // $x now contains "yyyyyyyyyyyyyyy"
	var_dump($x);
	echo '<br/>'; 
	
 	$gft = new gft();
	$gft->info(33);
	
	// $x has been changed ????
	// $x contains what was echoed in the function 'info'
	var_dump($x); 
	echo '<br/>'; 
} 
class gft{
	private $strVal = 'abcd ';	
	public function info($info, $prefix = ' Info:'){
		echo $this->strVal.$prefix.serialize($info).'aaaa';
		echo '<br/>'; 
	}
}


Expected result:
----------------
string(15) "yyyyyyyyyyyyyyy"
xxxx Info:i:33;aaaa
string(15) "yyyyyyyyyyyyyyy"

Actual result:
--------------
string(15) "yyyyyyyyyyyyyyy"
xxxx Info:i:33;aaaa
string(19) "xxxx Info:i:33;aaaa"

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2021-03-17 10:06 UTC] nikic@php.net
-Status: Open +Status: Verified -Assigned To: +Assigned To: dmitry
 [2021-03-17 10:06 UTC] nikic@php.net
Asserts under -d opcache.jit=function:

php: /home/nikic/php/php-8.0/Zend/zend_variables.c:65: zend_string_destroy: Assertion `zend_gc_refcount(&(str)->gc) == 0' failed.
 [2021-03-17 13:55 UTC] dmitry@php.net
Automatic comment on behalf of dmitry@zend.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=faf1567212bb83e39bf113149bf31abf719ca3a5
Log: Fixed bug #80839 (PHP problem with JIT)
 [2021-03-17 13:55 UTC] dmitry@php.net
-Status: Verified +Status: Closed
 
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Sun Apr 18 17:01:24 2021 UTC