1
0
mirror of https://github.com/php/php-src.git synced 2026-04-29 19:23:22 +02:00
Commit Graph

796 Commits

Author SHA1 Message Date
Dmitry Stogov 512dfaba3a JIT: Fixed incorrect named parameter handling 2021-09-30 14:51:43 +03:00
Dmitry Stogov 4b31cb3eb8 JIT: Fixed memory leak 2021-09-30 13:01:56 +03:00
Dmitry Stogov 7710047ed1 JIT x86: Fixed NaN handling 2021-09-28 23:49:26 +03:00
Dmitry Stogov c30298bf57 Tracing JIT: Fixed possible memory-leak or missed destructor call.
Reference-counter of return_value may be indirectly decremented to 1.
2021-09-28 22:40:04 +03:00
Nikita Popov 97b5eeeb6c Fix leak with ASSIGN_OBJ on null
We still need to free op1 in this case.

Fixes oss-fuzz 5782176231194624 (part of #38542).
2021-09-28 16:33:11 +02:00
Dmitry Stogov 3fd1f6cdad JIT: Fixed label mess 2021-09-28 15:21:11 +03:00
Dmitry Stogov 17b127a84f JIT: Fixed result when assigning to typed reference 2021-09-28 14:19:23 +03:00
Nikita Popov 0391c55b0c Check exception before using undef_result_after_exception()
undefined_op_helper_write() can return 0 not just if an exception
is thrown, so check this explicitly. This fixes an issue introduced
in fe1633f010.
2021-09-28 12:22:12 +02:00
Nikita Popov fe1633f010 Undef result if undef dim warning promoted to exception
Fixes oss-fuzz #39278.
2021-09-28 11:35:53 +02:00
Nikita Popov f381079398 Check exception after QM_ASSIGN of undef var
While most other exceptions aren't possible when QM_ASSIGN is used
instead of ASSIGN, we still have to watch out for an undef var
notice being promoted to an exception.
2021-09-28 10:58:20 +02:00
Dmitry Stogov 2e02b1f157 JIT: Call zend_hash_index_find() instead of _zend_hash_index_find() if we didn't check for packed array before 2021-09-27 23:16:47 +03:00
Dmitry Stogov 325865d750 JIT: Split zend_jit_hash_index_lookup_rw() into zend_jit_hash_index_lookup_rw() and zend_jit_hash_index_lookup_rw_no_packed().
The previous version might fail if zend_jit_hash_index_lookup_rw() was called for packed array.
2021-09-27 22:09:51 +03:00
Dmitry Stogov 9ce388b41b JIT: Fixed missed zval type initialization 2021-09-27 20:05:50 +03:00
Dmitry Stogov 3e6919cfb3 Tracing JIT: Fixed possible incorrect megamorphic call from a trait 2021-09-23 23:38:03 +03:00
Dmitry Stogov 430454268f Tracing JIT: Remove incorrect assertion 2021-09-23 12:14:33 +03:00
Dmitry Stogov 08100e81e5 Tracing JIT: Fixed possible stack-buffer-overflow. 2021-09-23 10:51:20 +03:00
Dmitry Stogov 17a99f2b11 Check for zend_shared_alloc() failures 2021-09-23 01:00:50 +03:00
Dmitry Stogov 09d4037a17 JIT: Fixed possible memory leak 2021-09-22 22:57:57 +03:00
Nikita Popov 770879702a Fix JIT typed property inc/dec
This was leaking memory for pre-inc/dec of a refcounted typed
property if the result was not used.

The code to do this was unnecessarily complicated, we can base
this on the zend_jit_inc/dec_typed_prop() helper and copy to the
result afterwards.
2021-09-22 15:32:19 +02:00
Dmitry Stogov 7a93a8a6fd JIT: Fixed JIT for FETCH_OBJ when op1 is a reference of non-object 2021-09-22 14:52:25 +03:00
Dmitry Stogov 19854371ed Tracing JIT: Fixed bug in register allocator.
Type of variable might need to be checked (using type guard) before loading to register.
2021-09-22 00:43:56 +03:00
Nikita Popov f4bcf8c393 Check for undef var in typed property assignment
Without this check the assignment would actually silently succeed,
not just skip the warning.
2021-09-21 14:09:26 +02:00
Dmitry Stogov 48d050ef72 JIT: Disable recursive call optimization for VM without global register variables
A tail-call to VM handler from recursively called function may lead to
pass control to incorrect stack frame.
2021-09-21 14:30:56 +03:00
Nikita Popov 95e0cc06a2 Fix missing undef checks for comparisons 2021-09-21 12:06:32 +02:00
Dmitry Stogov 0e0f50b413 JIT x86: Fixed incorrect EX(func) initialization for recursive calls 2021-09-21 13:01:27 +03:00
Dmitry Stogov f0f774a129 JIT x86: Fixed register clobbering in code produced for "$x[$y] %= $z". 2021-09-21 10:42:53 +03:00
Dmitry Stogov 01cfd5e4f9 JIT: Fixed incorrect assignment of undefined variable 2021-09-17 18:35:55 +03:00
Dmitry Stogov 015cafa38c JIT: keep register value across call 2021-09-17 17:58:24 +03:00
Dmitry Stogov 04209de93c JIT: Fixed warning when assign undefined variable to property 2021-09-17 16:22:06 +03:00
Nikita Popov d46b10296e Don't jit FE_RESET_R with undef operand
The implementation currently assumes that the operand is always
an array, but this did not account for a possibly undef operand.
2021-09-17 12:04:21 +02:00
Dmitry Stogov 5e3eaf14fe JIT: Fixed memory leak in BOOL_NOT when opearnd ia a reference to bool 2021-09-16 17:18:51 +03:00
Nikita Popov 83f283f5ea Undef result on throwing typed reference assignment 2021-09-16 15:48:10 +02:00
Dmitry Stogov 236e7aef01 JIT: Fixed call chain construction 2021-09-15 17:27:05 +03:00
Nikita Popov 6de8b08f60 Don't undef result operand if there is none
The mod_by_zero and negative_shift helper may also be used by
ASSIGN_OP, in which case there is not necessarily a result operand.
If the stars aligned just right, this used to clobber other parts
of the call frame.

For these two helpers, check whether the result_type is TMP/VAR
before setting to UNDEF:
2021-09-15 14:49:13 +02:00
Nikita Popov 3ee85ccd4a Handle undef assignment to typed ref 2021-09-15 10:58:01 +02:00
Nikita Popov 10bbff8758 Fix JIT for recursive call with too few args
We may not generate labels for all leading RECVs. Don't generate
a direct jump if we have less arguments than required.
2021-09-14 15:15:14 +02:00
Nikita Popov e7663785a7 Handle undef value in assign_dim jit
We should report the undefined variable here and convert it to
null. Passing on undef is particularly insidious here, because
a write_dimension handler may insert it into a hash table
(observed with WeakMap).
2021-09-13 11:09:00 +02:00
Hao Sun cfb21e8dc1 JIT: Fixed exit from CALL VM with GCC Global Register Variables
PHP JIT supports three configurations: HYRBID, CALL with global register
variables feature(CALL+GRV for short), and CALL+noGRV.

CALL+GRV mode can be built with the following commands:

```
  php Zend/zend_vm_gen.php --with-vm-kind=CALL
  ./buildconf -f; ./configure; make
```

About 230 test cases failed for tracing JIT under CALL+GRV mode on both
x86 and arm64 machines.

For CALL+GRV mode, the condition to determine whether the execution of
an oparray is finished, is "opline == NULL". See function execute_ex()
around line "if (UNEXPECTED(!OPLINE)) {".

However, such cleanup operation is missing for the JIT wrapper
zend_jit_trace_counter_helper(), and the trace_halt stub function.

Tests:
1. test cases: all .phpt test cases under "Zend/tests/ tests/
ext/opcache/tests/jit/".
2. both JIT/x86 and JIT/arm64: function JIT, tracing JIT and tracing JIT
with "--repeat 3"
3. execution modes: NTS/ZTS, HYBRID/CALL+GRV/CALL+noGRV

In my local test, these test cases passed under all JIT configrations.
2021-09-13 11:35:12 +03:00
Nikita Popov 8c3d33a054 Also make sure binary op operands can't be undef
Otherwise we will end up passing undef to xyz_function etc, which
is not permitted.
2021-09-09 15:08:08 +02:00
Nikita Popov bac054dbf3 Check whether expected types are present for compound op jit
zend_jit_long_math_helper() implicitly assumes that the operands
MAY_BE_LONG (but can also have additional types). It will normally
only be called if this is guaranteed. However, for compound
array/object assignment ops this was not check. Generalize the
existing check for assign_op to apply to these as well.

Of course, we could also make the code support this correctly,
but I don't think it makes sense to JIT these if the type we're
specializing for is not present.

Closes GH-7481.
2021-09-09 14:32:14 +02:00
Dmitry Stogov 06275d940c JIT: fixed MUL+SEND optimization when MUL throws an exception 2021-09-08 17:53:23 +03:00
Nikita Popov e22fb46127 Save register before throwing undef var notice
Otherwise we may clobber it while throwing the undef var notice.
This makes the implementation for assign_dim_op line up with
fetch_dim.
2021-09-08 14:45:49 +02:00
Nikita Popov b0e16f0e4f Fix jump after zend_jit_invalid_property_assign()
This is supposed to go to the FREE_OP_DATA, currently it crashes.
2021-09-08 12:27:54 +02:00
Dmitry Stogov 8fbeebec34 Fixed typo 2021-07-22 16:14:26 +03:00
Dmitry Stogov 053c56f52e Fixed bug #81226 (Integer overflow behavior is different with JIT enabled) 2021-07-21 19:28:43 +03:00
Dmitry Stogov 02acc5ad3b Fixed Bug #81255 (Memory leak in PHPUnit with functional JIT) 2021-07-20 22:14:32 +03:00
Christoph M. Becker ef77d3c89f Fix #81206: Multiple PHP processes crash with JIT enabled
We need to avoid resetting the JIT for all SAPIs, but we need to
initialize the JIT handlers even when only reattaching on Windows.

Closes GH-7208.
2021-07-19 23:45:37 +02:00
Dmitry Stogov 15abbea5e7 Avoid ASAN integer overflow warnings 2021-07-19 14:53:23 +03:00
Hao Sun c5d93aeee9 Fixed incorrec immediate encoding when using LEA optimization 2021-07-19 14:51:08 +03:00
Dmitry Stogov c0e4932816 Fixed bug #81249 (Intermittent property assignment failure with JIT enabled) 2021-07-19 12:11:09 +03:00