Skip to content

Commit

Permalink
Fix GH-17727: JIT SEGV on OOM in dtor when creating backtrace
Browse files Browse the repository at this point in the history
This became visible after GH-17056 was merged, but technically the lack
of setting the opline is also present on lower branches.
We set the opline to mirror the SAVE_OPLINE() from
ZEND_INIT_STATIC_METHOD_CALL().

Closes GH-17732.
  • Loading branch information
nielsdos committed Feb 17, 2025
1 parent 033a66b commit a54ed9e
Show file tree
Hide file tree
Showing 2 changed files with 32 additions and 0 deletions.
1 change: 1 addition & 0 deletions ext/opcache/jit/zend_jit_ir.c
Original file line number Diff line number Diff line change
Expand Up @@ -9327,6 +9327,7 @@ static int zend_jit_init_static_method_call(zend_jit_ctx *jit,
ir_IF_FALSE_cold(if_static);
}

jit_SET_EX_OPLINE(jit, opline);
ref = ir_CALL_3(IR_ADDR, ir_CONST_FC_FUNC(zend_jit_push_this_method_call_frame),
scope_ref,
func_ref,
Expand Down
31 changes: 31 additions & 0 deletions ext/opcache/tests/jit/gh17727.phpt
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
--TEST--
GH-17727 (JIT SEGV on OOM in dtor when creating backtrace)
--EXTENSIONS--
opcache
--SKIPIF--
<?php
if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
?>
--INI--
opcache.jit=1254
fatal_error_backtraces=1
memory_limit=2M
--CREDITS--
arnaud-lb
YuanchengJiang
--FILE--
<?php
$str = str_repeat('a', 1024 * 1024 * 1.25);
class DestructableObject
{
public function __destruct()
{
DestructableObject::__destruct();
}
}
$_ = new DestructableObject();
?>
--EXPECTF--
Fatal error: Allowed memory size of 2097152 bytes exhausted %s
Stack trace:
%A

0 comments on commit a54ed9e

Please sign in to comment.