Skip to content

Commit

Permalink
Fix JIT crash with large number of match/switch arms (php#8961)
Browse files Browse the repository at this point in the history
Switch statements may generate a large number of exit points. Once the max
number of exit points is reached, get_exit_addr() returns NULL. This was not
checked, and this resulted in a jump table with some 0 addresses.
  • Loading branch information
arnaud-lb authored Jul 18, 2022
1 parent b734d45 commit f2381ae
Show file tree
Hide file tree
Showing 5 changed files with 1,103 additions and 1 deletion.
2 changes: 1 addition & 1 deletion .editorconfig
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ end_of_line = lf
charset = utf-8
tab_width = 4

[{*.{awk,bat,c,cpp,d,h,l,re,skl,w32,y},Makefile*}]
[{*.{awk,bat,c,cpp,d,dasc,h,l,re,skl,w32,y},Makefile*}]
indent_size = 4
indent_style = tab

Expand Down
6 changes: 6 additions & 0 deletions ext/opcache/jit/zend_jit_arm64.dasc
Original file line number Diff line number Diff line change
Expand Up @@ -13992,6 +13992,9 @@ static int zend_jit_hash_jmp(dasm_State **Dst, const zend_op *opline, const zend
} else {
exit_point = zend_jit_trace_get_exit_point(target, 0);
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
if (!exit_addr) {
return 0;
}
| .addr &exit_addr
}
}
Expand Down Expand Up @@ -14154,6 +14157,9 @@ static int zend_jit_switch(dasm_State **Dst, const zend_op *opline, const zend_o
} else {
exit_point = zend_jit_trace_get_exit_point(target, 0);
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
if (!exit_addr) {
return 0;
}
| .addr &exit_addr
}
}
Expand Down
6 changes: 6 additions & 0 deletions ext/opcache/jit/zend_jit_x86.dasc
Original file line number Diff line number Diff line change
Expand Up @@ -14877,6 +14877,9 @@ static int zend_jit_hash_jmp(dasm_State **Dst, const zend_op *opline, const zend
} else {
exit_point = zend_jit_trace_get_exit_point(target, 0);
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
if (!exit_addr) {
return 0;
}
| .aword &exit_addr
}
}
Expand Down Expand Up @@ -15043,6 +15046,9 @@ static int zend_jit_switch(dasm_State **Dst, const zend_op *opline, const zend_o
} else {
exit_point = zend_jit_trace_get_exit_point(target, 0);
exit_addr = zend_jit_trace_get_exit_addr(exit_point);
if (!exit_addr) {
return 0;
}
| .aword &exit_addr
}
}
Expand Down
Loading

0 comments on commit f2381ae

Please sign in to comment.