Skip to content

Commit 466e4dc

Browse files
arnaud-lbarnaud-lb
authored
Check return value of zend_jit_trace_get_exit_addr() (#9097)
1 parent f8d62b4 commit 466e4dc

File tree

2 files changed

+61
-0
lines changed

2 files changed

+61
-0
lines changed

‎ext/opcache/jit/zend_jit_arm64.dasc

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2997,6 +2997,9 @@ static int zend_jit_trace_end(dasm_State **Dst, zend_jit_trace_info *t)
29972997
|.cold_code
29982998
for (i = 0; i < t->exit_count; i++) {
29992999
exit_addr = zend_jit_trace_get_exit_addr(i);
3000+
if (!exit_addr) {
3001+
return 0;
3002+
}
30003003
| b &exit_addr
30013004
}
30023005
|=>1: // end of the code
@@ -3809,6 +3812,9 @@ static int zend_jit_inc_dec(dasm_State **Dst, const zend_op *opline, uint32_t op
38093812

38103813
exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
38113814
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
3815+
if (!exit_addr) {
3816+
return 0;
3817+
}
38123818
| bvs &exit_addr
38133819

38143820
if ((opline->opcode == ZEND_PRE_INC || opline->opcode == ZEND_PRE_DEC) &&
@@ -4111,6 +4117,9 @@ static int zend_jit_math_long_long(dasm_State **Dst,
41114117
if (res_info & MAY_BE_GUARD) {
41124118
int32_t exit_point = zend_jit_trace_get_exit_point(opline, 0);
41134119
const void *exit_addr = zend_jit_trace_get_exit_addr(exit_point);
4120+
if (!exit_addr) {
4121+
return 0;
4122+
}
41144123
if ((res_info & MAY_BE_ANY) == MAY_BE_LONG) {
41154124
if (use_ovf_flag) {
41164125
| bvs &exit_addr
@@ -6319,6 +6328,9 @@ static int zend_jit_assign_dim_op(dasm_State **Dst, const zend_op *opline, uint3
63196328
&& !(op2_info & ((MAY_BE_ANY|MAY_BE_UNDEF) - (MAY_BE_LONG|MAY_BE_STRING)))) {
63206329
int32_t exit_point = zend_jit_trace_get_exit_point(opline, 0);
63216330
not_found_exit_addr = zend_jit_trace_get_exit_addr(exit_point);
6331+
if (!not_found_exit_addr) {
6332+
return 0;
6333+
}
63226334
}
63236335

63246336
if (!zend_jit_fetch_dimension_address_inner(Dst, opline, BP_VAR_RW, op1_info, op2_info, dim_type, NULL, not_found_exit_addr, NULL)) {
@@ -12498,6 +12510,9 @@ static int zend_jit_fetch_obj(dasm_State **Dst,
1249812510
&& (op1_info & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_OBJECT) {
1249912511
exit_point = zend_jit_trace_get_exit_point(opline, 0);
1250012512
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
12513+
if (!exit_addr) {
12514+
return 0;
12515+
}
1250112516
} else {
1250212517
val_addr = ZEND_ADDR_MEM_ZVAL(ZREG_REG0, 0);
1250312518
| LOAD_ZVAL_ADDR REG0, prop_addr
@@ -12888,6 +12903,9 @@ static int zend_jit_incdec_obj(dasm_State **Dst,
1288812903
if (use_prop_guard) {
1288912904
int32_t exit_point = zend_jit_trace_get_exit_point(opline, 0);
1289012905
const void *exit_addr = zend_jit_trace_get_exit_addr(exit_point);
12906+
if (!exit_addr) {
12907+
return 0;
12908+
}
1289112909

1289212910
| IF_NOT_ZVAL_TYPE var_addr, prop_type, &exit_addr, ZREG_TMP1
1289312911
var_info = (1 << prop_type) | (var_info & ~(MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF));
@@ -13027,6 +13045,9 @@ static int zend_jit_incdec_obj(dasm_State **Dst,
1302713045
SET_STACK_TYPE(stack, EX_VAR_TO_NUM(opline->result.var), IS_DOUBLE, 0);
1302813046
exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
1302913047
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
13048+
if (!exit_addr) {
13049+
return 0;
13050+
}
1303013051
SET_STACK_INFO(stack, EX_VAR_TO_NUM(opline->result.var), old_res_info);
1303113052
ssa->var_info[ssa_op->result_def].type = res_info & ~MAY_BE_GUARD;
1303213053
| b &exit_addr
@@ -13320,6 +13341,9 @@ static int zend_jit_assign_obj_op(dasm_State **Dst,
1332013341
if (use_prop_guard) {
1332113342
int32_t exit_point = zend_jit_trace_get_exit_point(opline, 0);
1332213343
const void *exit_addr = zend_jit_trace_get_exit_addr(exit_point);
13344+
if (!exit_addr) {
13345+
return 0;
13346+
}
1332313347

1332413348
| IF_NOT_ZVAL_TYPE var_addr, prop_type, &exit_addr, ZREG_TMP1
1332513349
var_info = (1 << prop_type) | (var_info & ~(MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF));
@@ -14095,10 +14119,16 @@ static int zend_jit_switch(dasm_State **Dst, const zend_op *opline, const zend_o
1409514119
if (next_opline != opline + 1) {
1409614120
exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
1409714121
fallback_label = zend_jit_trace_get_exit_addr(exit_point);
14122+
if (!fallback_label) {
14123+
return 0;
14124+
}
1409814125
}
1409914126
if (next_opline != default_opline) {
1410014127
exit_point = zend_jit_trace_get_exit_point(default_opline, 0);
1410114128
default_label = zend_jit_trace_get_exit_addr(exit_point);
14129+
if (!default_label) {
14130+
return 0;
14131+
}
1410214132
}
1410314133
}
1410414134

‎ext/opcache/jit/zend_jit_x86.dasc

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4166,6 +4166,9 @@ static int zend_jit_inc_dec(dasm_State **Dst, const zend_op *opline, uint32_t op
41664166

41674167
exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
41684168
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
4169+
if (!exit_addr) {
4170+
return 0;
4171+
}
41694172
| jo &exit_addr
41704173

41714174
if ((opline->opcode == ZEND_PRE_INC || opline->opcode == ZEND_PRE_DEC) &&
@@ -4465,6 +4468,9 @@ static int zend_jit_math_long_long(dasm_State **Dst,
44654468
if (res_info & MAY_BE_GUARD) {
44664469
int32_t exit_point = zend_jit_trace_get_exit_point(opline, 0);
44674470
const void *exit_addr = zend_jit_trace_get_exit_addr(exit_point);
4471+
if (!exit_addr) {
4472+
return 0;
4473+
}
44684474
if ((res_info & MAY_BE_ANY) == MAY_BE_LONG) {
44694475
| jo &exit_addr
44704476
if (Z_MODE(res_addr) == IS_REG && result_reg != Z_REG(res_addr)) {
@@ -6852,6 +6858,9 @@ static int zend_jit_assign_dim_op(dasm_State **Dst, const zend_op *opline, uint3
68526858
&& !(op2_info & ((MAY_BE_ANY|MAY_BE_UNDEF) - (MAY_BE_LONG|MAY_BE_STRING)))) {
68536859
int32_t exit_point = zend_jit_trace_get_exit_point(opline, 0);
68546860
not_found_exit_addr = zend_jit_trace_get_exit_addr(exit_point);
6861+
if (!not_found_exit_addr) {
6862+
return 0;
6863+
}
68556864
}
68566865

68576866
if (!zend_jit_fetch_dimension_address_inner(Dst, opline, BP_VAR_RW, op1_info, op2_info, dim_type, NULL, not_found_exit_addr, NULL)) {
@@ -13235,6 +13244,9 @@ static int zend_jit_fetch_obj(dasm_State **Dst,
1323513244
&& (op1_info & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_OBJECT) {
1323613245
exit_point = zend_jit_trace_get_exit_point(opline, 0);
1323713246
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
13247+
if (!exit_addr) {
13248+
return 0;
13249+
}
1323813250
} else {
1323913251
val_addr = ZEND_ADDR_MEM_ZVAL(ZREG_R0, 0);
1324013252
| LOAD_ZVAL_ADDR r0, prop_addr
@@ -13626,6 +13638,9 @@ static int zend_jit_incdec_obj(dasm_State **Dst,
1362613638
if (use_prop_guard) {
1362713639
int32_t exit_point = zend_jit_trace_get_exit_point(opline, 0);
1362813640
const void *exit_addr = zend_jit_trace_get_exit_addr(exit_point);
13641+
if (!exit_addr) {
13642+
return 0;
13643+
}
1362913644

1363013645
| IF_NOT_ZVAL_TYPE var_addr, prop_type, &exit_addr
1363113646
var_info = (1 << prop_type) | (var_info & ~(MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF));
@@ -13784,6 +13799,9 @@ static int zend_jit_incdec_obj(dasm_State **Dst,
1378413799
SET_STACK_TYPE(stack, EX_VAR_TO_NUM(opline->result.var), IS_DOUBLE, 0);
1378513800
exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
1378613801
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
13802+
if (!exit_addr) {
13803+
return 0;
13804+
}
1378713805
SET_STACK_INFO(stack, EX_VAR_TO_NUM(opline->result.var), old_res_info);
1378813806
ssa->var_info[ssa_op->result_def].type = res_info & ~MAY_BE_GUARD;
1378913807
| jmp &exit_addr
@@ -14107,6 +14125,9 @@ static int zend_jit_assign_obj_op(dasm_State **Dst,
1410714125
if (use_prop_guard) {
1410814126
int32_t exit_point = zend_jit_trace_get_exit_point(opline, 0);
1410914127
const void *exit_addr = zend_jit_trace_get_exit_addr(exit_point);
14128+
if (!exit_addr) {
14129+
return 0;
14130+
}
1411014131

1411114132
| IF_NOT_ZVAL_TYPE var_addr, prop_type, &exit_addr
1411214133
var_info = (1 << prop_type) | (var_info & ~(MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_REF));
@@ -14807,6 +14828,10 @@ static int zend_jit_fetch_this(dasm_State **Dst, const zend_op *opline, const ze
1480714828
int32_t exit_point = zend_jit_trace_get_exit_point(opline, ZEND_JIT_EXIT_TO_VM);
1480814829
const void *exit_addr = zend_jit_trace_get_exit_addr(exit_point);
1480914830

14831+
if (!exit_addr) {
14832+
return 0;
14833+
}
14834+
1481014835
| cmp byte EX->This.u1.v.type, IS_OBJECT
1481114836
| jne &exit_addr
1481214837

@@ -14980,10 +15005,16 @@ static int zend_jit_switch(dasm_State **Dst, const zend_op *opline, const zend_o
1498015005
if (next_opline != opline + 1) {
1498115006
exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
1498215007
fallback_label = zend_jit_trace_get_exit_addr(exit_point);
15008+
if (!fallback_label) {
15009+
return 0;
15010+
}
1498315011
}
1498415012
if (next_opline != default_opline) {
1498515013
exit_point = zend_jit_trace_get_exit_point(default_opline, 0);
1498615014
default_label = zend_jit_trace_get_exit_addr(exit_point);
15015+
if (!default_label) {
15016+
return 0;
15017+
}
1498715018
}
1498815019
}
1498915020

0 commit comments

Comments
 (0)