1
0
mirror of https://github.com/php/php-src.git synced 2026-04-25 17:08:14 +02:00
Commit Graph

6627 Commits

Author SHA1 Message Date
Arnaud Le Blanc 294e408ca2 Merge branch 'PHP-8.4' into PHP-8.5
* PHP-8.4:
  Fix race condition in zend_runtime_jit(), zend_jit_hot_func()
2025-10-07 10:53:53 +02:00
Arnaud Le Blanc 359ad80c4a Fix race condition in zend_runtime_jit(), zend_jit_hot_func()
zend_runtime_jit() prevents concurrent compilation with
zend_shared_alloc_lock(), but this doesn't prevent blocked threads from
trying to compile the function again after they acquire the lock.

In the case of GH-19889, one of the function entries is compiled with
zend_jit_handler(), which fails when the op handler has already been replaced by
a JIT'ed handler.

Fix by marking compiled functions with a new flag ZEND_FUNC_JITED, and
skipping compilation of marked functions. The same fix is applied to
zend_jit_hot_func().

Fixes GH-19889
Closes GH-19971
2025-10-07 10:48:44 +02:00
Ilija Tovilo faa4c7f9e6 Fix flaky gh19984.phpt test
When the parent finishes before the child, we may miss some output from the
child and have the test fail.
2025-10-03 22:25:18 +02:00
Ilija Tovilo bcd4be7d50 Fix double-free of EG(errors)/persistent_script->warnings on persist of already persisted file
Both processes race to compile warning_replay.inc. Whichever is first will get
to persist the script. The loser will use the script that is already persisted,
and the script that was just compiled is freed.

However, EG(errors) and persistent_script->warnings still refer to the same
allocation, and EG(errors) becomes a dangling pointer. To solve this, we simply
don't free warnings from free_persistent_script() anymore to maintain exclusive
ownership for EG(errors).

Furthermore, we need to adjust a call to zend_emit_recorded_errors() that would
previously use EG(errors), even when persistent_script has been swapped out.

Fixes GH-19984
Closes GH-19995
2025-09-30 22:53:25 +02:00
Gina Peter Banyard b4b0155f64 opcache: Fix segfault in function JIT due to NAN to bool warning (#19947) 2025-09-24 16:48:02 +01:00
Gina Peter Banyard 320fe2975b core: Warn when coercing NAN to other types
RFC: https://wiki.php.net/rfc/warnings-php-8-5#coercing_nan_to_other_types

Closes GH-19573
2025-09-23 11:16:51 +01:00
Gina Peter Banyard d27e1e1723 core: Add new test for coercions from NAN 2025-09-23 11:14:58 +01:00
Dmitry Stogov 83ccc97d80 Merge branch 'PHP-8.4'
* PHP-8.4:
  Update IR
2025-09-22 20:14:49 +03:00
Dmitry Stogov 1302b9f6da Update IR
IR commit: 425ca45ffed99b6d3085c6a7f7c9d4fb3c2b5737
2025-09-22 20:14:21 +03:00
Dmitry Stogov 58981ade34 Merge branch 'PHP-8.4'
* PHP-8.4:
  Update IR
2025-09-22 19:31:41 +03:00
Dmitry Stogov ef202cc4b7 Update IR
IR commit: 503018483d8333a3cfb25ab89a1eadefbee665bc
2025-09-22 19:31:06 +03:00
Arnaud Le Blanc f0878c8e30 Merge branch 'PHP-8.4'
* PHP-8.4:
  Handle references after FETCH_OBJ_R with REG destination
2025-09-22 17:57:35 +02:00
Arnaud Le Blanc 32c919b474 Handle references after FETCH_OBJ_R with REG destination
zend_jit_fetch_obj_r_slow_ex() may be used by the function JIT, which doesn't
rely on guards to handle references. Therefore it must deref the property value.

Other variants of zend_jit_fetch_obj_*_slow_ex can not be used used in function
JIT.

Fixes GH-19831
Closes GH-19838
2025-09-22 17:56:57 +02:00
Gina Peter Banyard b4ed215299 core: Warn when non-representable floats are coerced to int (#19760)
RFC: https://wiki.php.net/rfc/warnings-php-8-5#casting_out_of_range_floats_to_int
2025-09-21 23:53:16 +01:00
Niels Dossche 527ce267dd Merge branch 'PHP-8.4'
* PHP-8.4:
  Fix GH-19792: SCCP causes UAF for return value if both warning and exception are triggered
2025-09-11 19:37:29 +02:00
Niels Dossche 3026e88b0c Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3:
  Fix GH-19792: SCCP causes UAF for return value if both warning and exception are triggered
2025-09-11 19:36:29 +02:00
Niels Dossche 2ad0b5cf05 Fix GH-19792: SCCP causes UAF for return value if both warning and exception are triggered
If an exception _and_ a warning (or deprecation) is emitted, then the
result is destroyed twice. Use an `else if` to prevent this.
This is tested via zend_test because the deprecation that triggered the
original reproducer may disappear in the future.

Closes GH-19793.
2025-09-11 19:35:53 +02:00
Arnaud Le Blanc 75945580bc Fix deoptimization after exit during inc/dec
When the assumption that (PRE|POST)_(INC|DEC) overflows turns out to be
false and we exit, effects are lost if op1 or result were in regs.

Fix by updating the stack map before creating the exit point.

Fixes GH-19669
Closes GH-19680
2025-09-11 12:35:39 +02:00
Arnaud Le Blanc 4e0e88a140 Fix deoptimization after exit during inc/dec
When the assumption that (PRE|POST)_(INC|DEC) overflows turns out to be
false and we exit, effects are lost if op1 or result were in regs.

Fix by updating the stack map before creating the exit point.

Fixes GH-19669
Closes GH-19680
2025-09-11 12:28:45 +02:00
Dmitry Stogov 22d002e068 Merge branch 'PHP-8.4'
* PHP-8.4:
  Update IR
2025-09-10 17:08:56 +03:00
Dmitry Stogov 2ff7a18bdc Update IR
IR commit: 2283f5eedf2a238b4d819c1774e47f3721b80cd8
2025-09-10 17:08:17 +03:00
Alexandre Daubois 49e3956b70 core: Deprecate using null as an array offset and when calling array_key_exists() (#19511)
RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_using_values_null_as_an_array_offset_and_when_calling_array_key_exists
2025-09-04 22:12:24 +01:00
Arnaud Le Blanc 3625cbb344 Fix ZTS+JIT build on non-glibc/musl/freebsd/macos/win platforms
Fixes GH-19657
Closes GH-19667
2025-09-03 13:50:02 +02:00
Dmitry Stogov d25687b15f Merge branch 'PHP-8.4'
* PHP-8.4:
  Cleanup SSA(s) in case of fatal error during tracing JIT
2025-09-02 10:06:51 +03:00
Dmitry Stogov d59ae9345c Cleanup SSA(s) in case of fatal error during tracing JIT
This fixes segfault becuse of UAF in ext/standard/tests/gh14643_longname.phpt
2025-09-02 10:04:40 +03:00
Dmitry Stogov 7ea5c2b47f Merge branch 'PHP-8.4'
* PHP-8.4:
  Update IR
2025-09-02 10:02:33 +03:00
Dmitry Stogov 93740d0a82 Update IR
IR commit: 3d7ac467fc89c136866f11195355789d9850de9f
2025-09-02 10:01:52 +03:00
Arnaud Le Blanc 0ee7732c01 Fix opcache.huge_code_pages
Building opcache into the main executable breaks opcache.huge_code_pages,
as we were relying on the fact that accel_remap_huge_pages() is not in the
same mapping as the main text segment.

Here I ensure that accel_remap_huge_pages() is placed out of the text
segment, and remap only the text segment. This approach is used in [1].

Closes GH-19388.

[1] https://github.com/intel/iodlr/blob/676bb7dec378d561e4d900fbdaed6ce8dbe449a1/large_page-c/large_page.c#L260.
2025-09-01 19:36:11 +02:00
Arnaud Le Blanc 95d52d52da Fix JIT stack setup on aarch64/clang
On aarch64 we must set IR_USE_FRAME_POINTER to ensure that LR/x30 is
saved. Also, fixed_stack_frame_size must be n*16, not n*16+8 like on x86.

Fixes GH-19601
Closes GH-19630
2025-09-01 19:16:39 +02:00
Tim Düsterhus 2a086e4e73 opcache: Improve error messages when “temporarily enabling OPcache” (#19619)
* opcache: Do not emit “temporary enabling” message when OPcache is already active

An easy way to accidentally enable OPcache “temporarily” is by using
`php_admin_value[opcache.enable]=1` within a FPM pool’s configuration, since
the `php_admin_value` settings mostly behave like settings in php.ini, with
many OPcache INI settings being a notable exception.

As long as OPcache is already enabled within php.ini (or simply by default),
emitting a warning for `php_admin_value[opcache.enable]=1` or similar is going
to be confusing, since is not actually temporarily enabling anything.

A follow-up commit will also try to detect this kind of incorrect configuration
and try to provide better advice for cases where OPcache is actually not yet
enabled.

* opcache: Improve error message when OPcache is enabled dynamically

The error message will now advice on the `php_admin_value[opcache.enable]=1`
mistake. It will also send the message to OPcache’s logging facility instead of
the regular error handling logic during startup so that it will not be made
available to `error_get_last()`, since it is related to a specific request and
thus not actionable by a script either.

php/php-src#19146 made a related change to `opcache.memory_consumption`.

* opcache: Fix typo in warning message

* opcache: Use more formal language in warning message
2025-08-31 00:32:42 +02:00
Tim Düsterhus 914f9ad49b Optimizer/zend_dump: Fix printing of the exception table (#19634)
A newline was missing for finally blocks.
2025-08-29 19:58:44 +02:00
Gina Peter Banyard 8747e9ae18 Zend: Warn when destructuring non-array values (#19439)
RFC: https://wiki.php.net/rfc/warnings-php-8-5#destructuring_non-array_values
2025-08-29 16:06:34 +01:00
Arnaud Le Blanc 0fe24447bc Fix incorrect opline after deoptimization
Blacklisted side traces (aka JIT'ed exits) may return the previous opline
after calling the original op handler. As a result, the op handler is called
again by the VM.

Fix this by always returning the opline returned by the original op handler.

Always use zend_jit_vm_enter(jit, ref) to signal the VM that it must reload
EG(current_execute_data) as it may have changed during the execution of
the trace.

Fixes GH-19486
Closes GH-19535
2025-08-28 09:44:01 +02:00
Gina Peter Banyard 5d5ef5050a ext/opcache: Add missing INI setting in test 2025-08-28 00:45:39 +02:00
Gina Peter Banyard 93716bece4 Enact follow-up phase of the "Path to Saner Increment/Decrement operators" RFC (#19374)
RFC: https://wiki.php.net/rfc/deprecations_php_8_5#enact_follow-up_phase_of_the_path_to_saner_incrementdecrement_operators_rfc
2025-08-23 14:36:39 +01:00
Arnaud Le Blanc 73b98a3858 TAILCALL VM
Introduce the TAILCALL VM, a more efficient variant of the CALL VM:

 * Each opcode handler tailcalls the next opcode handler directly instead of
   returning to the interpreter loop. This eliminates call and interpreter loop
   overhead.
 * Opcode handlers use the preserve_none calling convention to eliminate
   register saving overhead.
 * preserve_none uses non-volatile registers for its first arguments, so
   execute_data and opline are usually kept in these registers and no code is
   required to forward them to the next handlers.

Generated machine code is similar to a direct-threaded VM with register pinning,
like the HYBRID VM.

JIT+TAILCALL VM also benefits from this compared to JIT+CALL VM:

 * JIT uses the registers of the execute_data and opline args as fixed regs,
   eliminating the need to move them in prologue.
 * Traces exit by tailcalling the next handler. No code is needed to forward
   execute_data and opline.
 * No register saving/restoring in epilogue/prologue.

The TAILCALL VM is used when the HYBRID VM is not supported, and the compiler
supports the musttail and preserve_none attributes: The HYBRID VM is used when
compiling with GCC, the TAILCALL VM when compiling with Clang>=19 on x86_64 or
aarch64, and the CALL VM otherwise.

This makes binaries built with Clang>=19 as fast as binaries built with GCC.
Before, these were considerably slower (by 2.8% to 44% depending on benchmark,
and by 5% to 77% before 76d7c616bb).

Closes GH-17849
Closes GH-18720
2025-08-22 18:05:52 +02:00
Daniel Scherzer 63acc4bf61 [RFC] Add #[\DelayedTargetValidation] attribute (#18817)
https://wiki.php.net/rfc/delayedtargetvalidation_attribute
2025-08-20 00:41:20 -07:00
Arnaud Le Blanc 504a633780 Merge branch 'PHP-8.4'
* PHP-8.4:
  Fit JIT variable not stored before YIELD
2025-08-19 15:54:46 +02:00
Arnaud Le Blanc bc05bfe7c5 Fit JIT variable not stored before YIELD
JIT doesn't recognize that variables may be used after returning from a
trace due to YIELD, so some effects may never be stored to memory.

YIELD ops terminate trace recordings with ZEND_JIT_TRACE_STOP_RETURN, and are
handled mostly like RETURN. Here I change zend_jit_trace_execute() so that
YIELD terminates recordings with ZEND_JIT_TRACE_STOP_INTERPRETER instead,
to ensure that we recognize that variables may be used after returning from
the trace due to YIELD.

Fixes GH-19493
Closes GH-19515
2025-08-19 15:49:29 +02:00
Alexandre Daubois 010fe2bb42 [RFC] Deprecate constant redeclaration (#19474)
https://wiki.php.net/rfc/deprecations_php_8_5
2025-08-16 09:54:37 -07:00
Dmitry Stogov 222f7517a1 Merge branch 'PHP-8.4'
* PHP-8.4:
  Added test for PR #19458
2025-08-13 15:59:57 +03:00
Dmitry Stogov cbb9ee8f5b Added test for PR #19458
Thanks to @DanielEScherzer
2025-08-13 15:58:04 +03:00
Dmitry Stogov 290c9aef56 Eliminate useless spill stores (#19467) 2025-08-13 13:46:14 +03:00
Tim Düsterhus 3d9d68e1ca zend_compile: Deprecate backticks as an alias for shell_exec() (#19443)
RFC: https://wiki.php.net/rfc/deprecations_php_8_5#deprecate_backticks_as_an_alias_for_shell_exec
2025-08-12 12:02:13 +02:00
Dmitry Stogov 07a9c25c71 Merge branch 'PHP-8.4'
* PHP-8.4:
  Fix Nightly workflow Symfony assertion (ir_ra.c:326: ir_fix_live_range: Assertion `ival && p->start == old_start' failed) (#19458)
2025-08-12 11:59:26 +03:00
Dmitry Stogov 47f9f3a3f6 Fix Nightly workflow Symfony assertion (ir_ra.c:326: ir_fix_live_range: Assertion `ival && p->start == old_start' failed) (#19458) 2025-08-12 11:59:08 +03:00
Theodore Brown 5f8d648af6 Deprecate terminating case statements with a semicolon (#19215)
Part of https://wiki.php.net/rfc/deprecations_php_8_5

Closes GH-15258
2025-08-11 14:18:06 +02:00
Arnaud Le Blanc e4078a6a70 Disable opcache if no SHM backend is available
Currently, configure fails when no SHM backend is available. Additionally,
even after bypassing the configure check, opcache emits a fatal error if no
SHM backend is available.

Make the configure check non-fatal (a warning is printed). At runtime, disable
opcache if no backend is available, in the same way we disable opcache by
default on CLI.

Closes GH-19350
2025-08-08 14:41:37 +02:00
Ilija Tovilo c69f04dbab Fix borked test 2025-08-06 22:25:14 +02:00
Arnaud Le Blanc 7af4709d38 Fix test 2025-08-06 19:57:32 +02:00