Skip to content

Fix GH-17747: Exception on reading property in register-based FETCH_OBJ_R breaks JIT #17749

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

Fix GH-17747: Exception on reading property in register-based FETCH_OBJ_R breaks JIT #17749

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
026d9ba
Fix GH-17747: Exception on reading property in register-based FETCH_O…
nielsdos Feb 9, 2025
7948daf
Review
nielsdos Feb 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions ext/opcache/jit/zend_jit_helpers.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1965,7 +1965,12 @@ static zval* ZEND_FASTCALL zend_jit_fetch_obj_r_slow_ex(zend_object *zobj)
void **cache_slot = CACHE_ADDR(opline->extended_value & ~ZEND_FETCH_OBJ_FLAGS);

retval = zobj->handlers->read_property(zobj, name, BP_VAR_R, cache_slot, result);
if (retval == result && UNEXPECTED(Z_ISREF_P(retval))) {
if (retval != result) {
/* On exception, we may free the result in the ZEND_HANDLE_EXCEPTION VM handler
* so we need to initialize the result.
* We don't need to copy because we use the return value directly as a register. */
ZVAL_UNDEF(result);
} else if (UNEXPECTED(Z_ISREF_P(retval))) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This may cause problems for case without exceptions, because the type in memory is changed and it may be inconsistent with inferred type.

I think, it's better to use zend_jit_check_exception_undef_result() instead of zend_jit_check_exception() when Z_MODE(res_addr) == IS_REG.

Copy link
Member Author

@nielsdos nielsdos Feb 10, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This may cause problems for case without exceptions, because the type in memory is changed and it may be inconsistent with inferred type.

I thought this didn't matter as the value isn't actually used (the bytes are uninitialized anyway in this case).

I think, it's better to use zend_jit_check_exception_undef_result() instead of zend_jit_check_exception() when Z_MODE(res_addr) == IS_REG.

I didn't know this helper existed, I should've looked better. This idea is actually something I briefly thought of doing myself but didn't know it existed already. Thanks for pointing out.

zend_unwrap_reference(retval);
}
return retval;
Expand Down Expand Up @@ -2017,7 +2022,12 @@ static zval* ZEND_FASTCALL zend_jit_fetch_obj_is_slow_ex(zend_object *zobj)
void **cache_slot = CACHE_ADDR(opline->extended_value & ~ZEND_FETCH_OBJ_FLAGS);

retval = zobj->handlers->read_property(zobj, name, BP_VAR_IS, cache_slot, result);
if (retval == result && UNEXPECTED(Z_ISREF_P(retval))) {
if (retval != result) {
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I could also check for &EG(uninitialized_zval) but that check may be more expensive and we need to compare retval and result anyway for the zend_unwrap_reference below.
On the other hand, the current approach may cause more memory writes.

/* On exception, we may free the result in the ZEND_HANDLE_EXCEPTION VM handler
* so we need to initialize the result.
* We don't need to copy because we use the return value directly as a register. */
ZVAL_UNDEF(result);
} else if (UNEXPECTED(Z_ISREF_P(retval))) {
zend_unwrap_reference(retval);
}
return retval;
Expand Down
23 changes: 23 additions & 0 deletions ext/opcache/tests/jit/gh17747.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
--TEST--
GH-17747 (Exception on reading property in register-based FETCH_OBJ_R breaks JIT)
--EXTENSIONS--
opcache
--INI--
opcache.jit=function
--FILE--
<?php
class C {
public int $a;
public function test() {
var_dump($this->a);
}
}
$test = new C;
$test->test();
?>
--EXPECTF--
Fatal error: Uncaught Error: Typed property C::$a must not be accessed before initialization in %s:%d
Stack trace:
#0 %s(%d): C->test()
#1 {main}
thrown in %s on line %d