Fix segfault in JIT#18289
Conversation
9e6b036 to
ce29717
Compare
ce29717 to
abac1f6
Compare
|
Hi, can you demonstrate the problem with a test case? |
|
No easy reproducer at this time. The issue is happening with Datadog's allocation profiler. We're working on verifying the issue manually with the customer which hit the issue. The rough idea at this time: if this path is taken, and allocations start happening then the profiler may gather a sample. Then we read a bad opline when walking the stack and collecting file and line information. |
|
@arnaud-lb doesn't this look similar to the problem you are fixing in #18297 |
There was a problem hiding this comment.
@dstogov I think this is a different issue.
This looks similar the classic issue where emitting an error from the allocator crashes because EX(opline) is not initialized (we crash when fetching the file/line for the error message). The usual fix is to save opline in op handlers that may allocate.
In this case the op handler is zend_jit_func_counter_helper() or zend_jit_loop_counter_helper(), which call zend_jit_hot_func(), so saving opline there seems fine.
For zend_jit_trace_counter_helper() we save in zend_jit_trace_hot_root() (here).
dstogov
left a comment
There was a problem hiding this comment.
OK. You convinced me. Approved.
|
Thank you @realFlowControl! |
This PR saves the opline, as otherwise it can be a dangling pointer